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Report of the ITA Findings to the NESC 
1 Identification 


ITA#: RP-04-0 1/03-00 1-E 

Requestor Name: William F. Townsend, 
Deputy Director, NASA Goddard Space 
Flight Center (GSFC) 

Requestor Contact Info: (301)-286-5066 
william, f. to wnsend(a)nasa. gov 
Code 100 

Short Title: CALIPSO Spacecraft Proteus Propulsion System Assessment 

Description: Personnel hazards associated with Proteus Hydrazine propulsion bus once 
loaded (launch-36 days) 

Date Received: 10-22-03 

Date ITA/I Initiated: 1 1-06-03 

NESC Chief Engineer (NCE) Assigned: 
Michael Hagopian 

NCE Contact Info: 301-286-6732 

Lead Assigned: Dr. Richard J. Gilbrech 

Lead Contact Info: 757-864-3303 

Date IT A/I Concluded: 01-27-05 (Ver. 2.0) 


2 Executive Summary 

The CALIPSO spacecraft is scheduled for launch on a Boeing Delta II rocket from Space Launch 
Complex-2 (SLC-2) at Vandenberg Air Force Base (VAFB) in 2005. CALIPSO uses an “off the 
shelf’ hydrazine-fueled Proteus propulsion bus manufactured by Alcatel Space Industries. Refer to 
Addendum 3 to this report for Alcatel site visit notes. The bus is provided by the Centre National 
d'Etudes Spatiales (CNES) as part of its in-kind contribution to the joint mission. While an identical 
bus was flown in 2001 on the Jason- 1 spacecraft, concerns have been raised by GSFC safety and 
engineering that the Proteus bus does not meet NASA fault tolerance design guidelines 1 or all of the 
Air Force Eastern and Western Range (EWR) requirements 2 , thus posing an unacceptable hazard to 
processing personnel. The Air Force EWR, Kennedy Space Center (KSC) Expendable Launch 
Vehicle Office, and Langley Research Center (LaRC) are all in agreement that the spacecraft is safe 
to process and launch given the planned spacecraft integrity testing and operational controls in place. 
GSFC believes the risks from these potential events have been incorrectly classified and has 
recommended additional measures to mitigate personnel hazards assuming the undesired events will 
occur. 

The scope of this effort was a review of the Proteus propulsion bus design and an assessment of the 
potential for personnel exposure to hydrazine propellant. Loss of mission, spacecraft or launch 
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facilities is obviously an undesired outcome, but was purposely placed outside the scope of this 
assessment. The duration of this assessment was two months. Specifically reviewed were the 
potential for leakage from the five (5) mechanical fittings on the Proteus bus, potential leakage 
through the thruster valves and the potential for an inadvertent firing of the thrusters. These 
personnel hazards exist only during the period when the system is filled and pressurized until launch 
(approximately 36 days). Material from a variety of sources was reviewed and a site visit was made 
to VAFB to review the payload processing facilities and Delta II pad where CALIPSO will be 
processed and launched. It should be noted that key CNES information requested for this assessment 
through the GSFC program office was not provided (ref. Appendix A). This fact limited the review 
team’s ability to draw conclusions based on objective evidence and formed the basis for many of the 
requirements. 

The NESC acknowledges that welded joints are superior to mechanical fittings in preventing leakage 
but attention to workmanship and proper verification of the joint integrity is required for both. 
Mechanical fittings do afford a greater degree of flexibility in the assembly and repair of tubing 
systems. However, a thorough risk assessment must be conducted early in the design process to 
arrive at a configuration that presents the overall minimum risk to personnel, the mission and the 
environment During the course of the review it was noted that the hydrazine system does not have a 
tank isolation valve. The NESC team acknowledges that the omission of a tank isolation valve in the 
propulsion feed system is less safe during ground operations than a system that has the capability to 
isolate leaks; but while one may be safer, both can be made safe through proper hardware 
development and launch site processes. Again, a thorough risk assessment must be performed when 
designing the spacecraft to make these configuration decisions. 

The Program adequately addressed all eleven (11) NESC requirements stated in this report and, 
therefore, the NESC concluded personnel risk is acceptable. Eight addendums to the original report 
have been added to this revision (Version 2.0) that provides the details substantiating the NESC 
position. The addendums describe a combination of tests, site inspections, analysis, and a summary 
briefing. 

3 Detailed Description of the Problem 

CALIPSO is a joint science mission between the CNES, LaRC and GSFC. It was selected as an 
Earth System Science Pathfinder satellite mission in December 1998 to address the role of clouds and 
aerosols in the Earth's radiation budget. The spacecraft includes a NASA light detecting and ranging 
(LIDAR) instrument, a NASA wide-field camera and a CNES imaging infrared radiometer. 
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The issues addressed in this assessment involve the Proteus spacecraft bus provided to CNES via 
subcontract with Alcatel Space Industries. This bus is identical to that flown on the Jason- 1 mission 
launched in December 2001 on a Delta II from VAFB. NASA’s Jet Propulsion Lab managed the 
Jason- 1 mission. Issues on CALIPSO are associated with the Proteus hydrazine propulsion system 
used for orbit corrections depicted in Figure 1. The system has five (5) mechanical MS-33656 37° 
Army/Navy (A/N) fittings, one located at each of the four (4) 0.225 pound-force thrusters (Astrium 
model CHT IN) and one at the outlet of the ten (10) gallon hydrazine tank manufactured by Rafael. 
All other connections in the hydrazine system are welded. 



Figure 1. Schematic of CALIPSO Propulsion System 


Three key issues have been highlighted: (1) use of mechanical fittings instead of welded joints for 
propulsion system fluid connections, (2) the potential for hydrazine leakage through thrusters, and (3) 
the potential for inadvertent thruster firing. Personnel risks associated with these issues are: 
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• Toxic exposure to hydrazine leakage from the mechanical fittings. 

• Toxic exposure to un-reacted hydrazine in the thruster exhaust via leakage through the 
thruster valves or inadvertent thruster firing. 

• Fire potential from hydrazine leakage and subsequent contact with incompatible spacecraft 
materials. 

• Fire potential from thruster hot gas exhaust igniting combustible spacecraft materials. 

4 Causal Factors 


NESC focused on the three key issues as stated above. A detailed assessment of the causal factors 
that could potentially lead to a catastrophic event can be found in the NESC-developed fault tree (ref. 
Appendix B). A more general discussion follows. 


Leakage through the mechanical fitting can be influenced by a number of design, environmental, 
assembly and processing factors. The design of the fitting must provide a consistent clamping force 
sufficient to provide sealing integrity in the environment to which it will be exposed. Key design 
factors include adequacy of structural/mechanical design margins and compatibility of material 
selections of the various A/N fitting components. Environmental factors that could influence leakage 
include temperature, pressure, vibration and shock. The environmental factors must consider the 
flight mission as well as those induced during spacecraft transportation and during ground 
processing. Assembly and processing factors that must be considered include proper torque 
application, potential for the introduction of contamination in the assembly and potential damage 
induced during assembly. A comprehensive qualification and acceptance test program can both 
certify the design for these conditions and verify the adequacy of the assembly process. 


Leakage through the thruster can also be influenced by a number of design, environmental, assembly 
and processing factors. Flow control valves located upstream of each thruster physically control 
propellant flow to the thruster catalyst bed. Key design factors for the valve include adequacy of 
structural/mechanical design margins and compatibility of material selected for the valve 
components. A number of environmental factors can influence the performance of the valve and its 
propensity for leakage. They include temperature, pressure, vibration and shock, and must be 
considered for both the flight mission as well as those induced during spacecraft transportation and 
ground processing. Risk of leakage through the flow control valves can be significantly reduced with 
a comprehensive qualification and acceptance test program by certifying the design and verifying the 
adequacy of the assembly process. 
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An inadvertent thruster firing could be initiated by unintentionally applying power to the actuation 
circuit, the drivers or the valve solenoids. The power source could be from the Ground Support 
Equipment (GSE) or an internal short in the spacecraft electronics. One additional influencing factor 
could be an inadvertent ON command by the spacecraft or GSE software. Typical safeguards used to 
minimize the potential for inadvertent thruster firing includes redundancy in the design which would 
require multiple failures to apply power and designs having multiple inhibits to prevent inadvertent 
application of power. 

5 NESC Risk Assessment 

5.1 Overview 

Anhydrous hydrazine (N 2 H 4 ) is a colorless, oily, flammable liquid that is miscible with water. It has 
a penetrating odor resembling that of ammonia with an odor threshold of 3.7 parts per million (ppm). 
The National Institute of Occupational Safety and Health's immediately dangerous to life or health 
(NIOSH IDLH) limit is set at 50 ppm 3 . This is the recommended exposure limit to ensure that a 
worker can escape from an exposure condition that is likely to cause death or immediate or delayed 
permanent adverse health effects or prevent escape from the environment. The Occupational Safety 
and Health Administration permissible exposure limit (OSHA PEL) for hydrazine is 1 ppm 4 . This is 
expressed as a time-weighted average and is the concentration of a substance to which most workers 
can be exposed without adverse effect averaged over a normal 8 -hour workday or a 40-hour work 
week. The American Conference of Governmental and Industrial Hygienists' threshold limit value 
(ACGIH TLV) is 0.01 ppm 5 and is expressed as a time- weighted average; the concentration of a 
substance to which most workers can be exposed without adverse effects. It should be noted that 
OSHA numbers are regulatory, whereas NIOSH and ACGIH numbers are advisory. NASA and the 
Air Force use the more stringent time-weighted TLV of 0.01 ppm as the limit for worker exposure 6 . 

Hydrazine liquid is extremely reactive and contact with incompatible materials can spur spontaneous 
combustion resulting in a fire. The explosive range of hydrazine in air is between 4.7 and 99 percent. 
Although hydrazine is detonable above concentrations of 4.7 percent in air, its low vapor pressure of 
0.27 pounds per square inch absolute makes it more difficult to build up sufficient concentrations in a 
well- ventilated area 7 . 

The fact a hazardous event is unlikely to occur does not mean it cannot occur. For the three fault tree 
events considered in Appendix B (leakage of the mechanical fittings, leakage through the thruster 
valves and inadvertent firing of the thruster) a wide range of probabilities were derived by the GSFC 
and LaRC Safety Offices along with differing opinions on severity. There is subjectivity in 
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determining an event probability as evidenced by the wide spread between the two safety offices. It 
was not feasible for the NESC to better quantify the probabilities through specific testing or analysis 
in the timeframe given. Hydrazine is a hazardous commodity and in the NESC assessment team’s 
judgment, the possibility of leakage does exist and the event severity is catastrophic to personnel. 
Given this premise, the focus of this assessment was to minimize the probability that the current 
design could initiate these undesired events and ensure operational controls are in place to maximize 
personnel safety. 

5.2 Fault Tree Analysis and Mitigation 

The CALIPSO fault tree (Appendix B) and mitigation table (Appendix C) were developed to identify 
all possible initiators leading to the three events and provide mitigation rationale for these events. 

The methods of verification specified by NASA system safety standards are inspection, test, analysis, 
demonstration and similarity. However, for this assessment, demonstration (“We flew it before”) and 
similarity (“It worked on Jason- 1”) were not used as a means of closing fault tree events. 

Specifically, closeout of fault tree events could not be made due to the lack of availability of 
assembly level procedures and specifications. Events that could not be closed were incorporated into 
the NESC requirements. 

6 Overview of the Initial ITA Plan 


NESC reviewed the Proteus propulsion system design to assess the potential for personnel exposure 
to hydrazine from mechanical fittings or thrusters as well as the potential for inadvertent thruster 
firing. This assessment focused only on hazards present from the time the propulsion system is filled 
with hydrazine and pressurized to final closeout for launch, a period of about 36 days. Suitability of 
the system for flight and the potential for damage to flight hardware or launch facilities during 
ground processing were considered program risks and were not addressed. Likewise, this assessment 
did not address workmanship issues. It was assumed that stamp warranties, training, and process 
controls were properly implemented, hardware was built to print and work tasks were complete as 
documented. 

Fault trees for each of the potential failures under assessment were developed as presented in 
Appendix B. Credible failure modes were identified and the controls the CALIPSO program has 
placed on those failures assessed. For failures the program has not already assessed or for which 
controls were deemed inadequate, independent testing was conducted to validate the program’s 
approach or additional controls were recommended. 
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7 Modifications to the ITA Plan 


While decisions to incorporate or eliminate certain tests were made as the assessment matured, the 
basic ITA approach outlined above remained unchanged. Initially, NESC planned to build a flight 
fidelity mockup of the hydrazine tank, tubing and thruster setup to perform leak and vibration testing. 
After NESC requests for accurate configuration drawings were denied to the program by CNES, the 
value of the vibration testing was deemed questionable and dropped. A separate issue arose when 
conflicting data on the compatibility of hydrazine with the nickel seal in the A/N fitting was 
discovered. Compatibility tests, consultation with material compatibility experts and a literature 
search were added. Information from NASA’s White Sands Test Facility (WSTF) surfaced during 
final report preparation that resulted in the addition of a 36 day room temperature nickel seal soak 
test. These results are provided in Addendum 4 to this report (see Section 9.1.2 for details). 
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9 ITA Identified Alternative Courses of Action 

9.1.0 - Mechanical Fitting Leakage 

Properly welded fluid connections are inherently more reliable than mechanical fittings and should be 
incorporated in fluid propulsion system designs when possible. There are some circumstances, 
however, under which mechanical fittings offer an appropriate design solution. Ready interface to 
off-the-shelf parts, ease of maintenance, or potential for damage to soft goods during welding all may 
dictate use of threaded joints. MS-33656 type 37° A/N-fittings have been employed successfully in 
aerospace applications for many years and are acceptable for limited use providing they are (1) 
properly assembled, (2) validated by leak check as an assembly before use, (3) exposed only to 
temperature, pressure, vibration and shock environments for which they are certified, and (4) 
incorporate a secondary locking feature. The Proteus bus uses five such fittings; one at the 
hydrazine tank outlet and one at each of the thruster inlets (see Figures 2 and 3 for details). While 
lock-wire is used as a secondary locking feature, it is suitable only for preventing significant rotation 
of the B-nut and full disengagement of the fitting. Lock-wire alone will not prevent loss of joint 

O 

preload with subsequent reduction of clamping force at the sealing surfaces, and thus cannot be 
counted upon to prevent a fitting from leaking. 
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Figure 3. Exploded View of MS-33656-4 Fitting 


While the NESC was not provided specific qualification and acceptance test data for the CALIPSO 
Proteus bus, the NESC reviewed relevant test data from other propulsion system and component 
tests. In general these tests addressed qualification, acceptance and sensitivity of the MS-33656 type 
37° A/N fittings for exposure to the environmental conditions of temperature, pressure, vibration, 
shock and assembly cycles. The following sections of this report summarize three test series 
conducted on the MS-33656 threaded fitting and the mitigating actions required to assure integrity of 
the CALIPSO Proteus bus fittings. 

9. 1.0.0 - Review Voi-Shan Results of Evaluation Tests Conducted on Voi-Shan Conical Seals 9 


The objective of this test program was to demonstrate that the Voi-Shan conical seal would 
consistently seal a flared A/N fitting tube connection under varying applications. The test conditions 
were established in order to simulate very stringent requirements that could be encountered in actual 
usage. The environmental exposure conditions used in this test series are similar to the requirements 
for the CALIPSO spacecraft and in many cases bound them. 
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The test series used various sizes of the A/N 815 (fitting end, superseded by MS 33656, currently AS 
4395), A/N 818 and A/N 819 (sleeve, superseded by MS 20819, currently AS5176), fittings and 
conical seals made in accordance with Voi-Shan standard VSF 1015 manufactured from aluminum, 
copper, tin and nickel. Test conditions included: 

1. Pressure at room temperature of 1500-4500 pounds per square inch gage (psig) induced with 
helium, air and nitrogen and 6000 psig induced with hydraulic fluid. 

2. Pressure at elevated temperature: 500°F at 3000 psig-air. 

3. Pressure testing during repeated disassembly/assembly: 1500 psig for 20 cycles and 300 psig 
for 30 cycles. 

4. Sine sweep vibration testing with 3000 psig pressure. 

5. Torque relaxation combined with time (6 to 360 hours), pressure cycling and vibration. 

6. Shock testing: 20g’s shock at 3000 psig helium, and 100 g’s shock at 3000 psig water. 

7. Thermal Shock at 200°F and 1500 psig-helium. 

8. Pressure Impulse testing from 0-4500 psig at 35 cycles per minute for 100 cycles. 

Several measurement techniques were used to measure leak rate depending on the tests being 
conducted. They included submersion in water or benzene, using a helium sensitive mass 
spectrometer, a visual inspection if liquids were being used as the pressure medium and pressure 
decay over time. Torque relaxation was measured by applying torque in the tightening direction and 
measuring the angle required to achieve to the original torque value. 

The published results show a robust design for all of the configurations tested within the conditions 
specified. Test results indicated that all of the joints remained sealed with no leakage measured. The 
torque relaxation tests did show some relaxation over time and after exposure to pressure cycles. In 
the pressure cycle testing the largest change in torque was 27% and this occurred after the first 
pressure cycle. Torque relaxation reduced to no relaxation after the third cycle and only showed 13% 
relaxation after the second cycle worst case. Results of vibration tests showed no torque loss after 
exposure to vibration. The assembly, checkout and acceptance testing processes conducted on the 
CALIPSO Proteus bus can mitigate the two conditions (time and exposure to pressure) that did show 
some torque loss sensitivity. 
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9.1.0. 1 - Review of European Retrievable Carrier (EURECA) Spacecraft Qualification Test 
Report for the ENN 51200 - Size 4 Joint for High Pressure Application 10 

The objective of this test program was to qualify the design of ENN 51200 E joint (MS-33656 flared 
tube connection) for the use in EURECA program for high-pressure applications. Qualification 
environments that the high-pressure joint was required to withstand include loads induced from the 
vibration environment, thermal environment, operational pressure and pressure cycling, mounting 
(assembly torque) activities, proof pressure and burst pressure. The environmental exposure 
conditions used in this test series are similar to the requirements for the CALIPSO spacecraft. Three 
configurations of tubing length combined with the MS-33656 fittings were included in the test series 
to represent different load influencing factors. These include an angle length configuration to induce 
torsion and bending on the fitting, a torsion lever configuration to induce torsion on the fitting, and a 
straight tube length to induce axial loads on the fitting during the thermal testing. Leak checks were 
performed pre and post exposure to the loading conditions. The setup for leak testing included a 
vacuum test chamber, the test article, a helium leak detector, a vacuum pump and a helium pressure 
supply. The external leak rate criteria indicated failure if it exceeded lxl O' 6 standard cubic 
centimeters per second (scc/sec). 

The published results of the test series indicated that there were no leak rate failures experienced for 
any of the three test configurations subjected to all of the loading conditions. The test report also 
emphasized that the loads induced by vibration in particular did not result in developing an external 
leak. 

9.1.0. 2 - Review of Experiments on the Robustness of Separable Fittings 11 

The objective of this test program was to investigate the effect of off nominal or stressing conditions 
on various mechanical fittings to assess the likelihood of leakage. Stressing conditions used in the 
test series included vibration (30 g’s root mean square for 300 sec), thermal stress (exposure to 
cryogenic temperature), misalignment (2 degree offset), under-torque (50 % of nominal), and 
assembly in the presence of foreign debris (scoring of the sealing surface). The Vi-inch size A/N 
fitting was one of four types being evaluated in the test series. Other types include a Dynatube fitting 
(beam seal tubing connector), a KC fitting (a modified A/N fitting with Teflon gasket), and a 
Swagelok fitting. Two test series were performed; one test series subjecting each fitting to various 
combinations of the stressing conditions and a second test series based on an eight row Taguchi 
matrix of conditions with the four fitting used in the first series plus one additional fitting called the 
GE fitting (A/N modified with a radiused or ball nose). Conditions for the second test series had also 
been modified based on results of the first test showing insensitivity to some of the stressing 
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conditions. The second test series has not been reported at this time so the following discussion is 
based on significant findings from the first test series. 

Preliminary results of the first series of tests showed a wide variability of the various fitting responses 
to off-nominal conditions and identified some insensitivities that are relevant to the CALIPSO 
assessment. Even though these tests cannot explicitly quantify the integrity of the %-inch A/N fitting 
in the CALIPSO Proteus bus, data from these tests does show insensitivity or an inherent robustness 
of the A/N type fitting to some of the relevant causal factors associated with the hydrazine leak 
potential. It was determined that vibration and misalignment were not significant factors in the 
probability of leaks in the separable fittings as results showed negligible effect on the sealing 
qualities of the fittings. Surprisingly, the test series showed that vibration tended, if anything, to 
reduce leak rates more often than it increased them. In no case did a previously non-leaking fitting 
start to leak as a result of vibration and in 13 cases having the under-torque condition with a 
measurable leak rate, 10 cases had reduced leak rates after vibration. The two under-torqued A/N 
fittings with the largest pre- vibration leak rate had an increase in leak rate post vibration. With regard 
to misalignment, it was reported that the fittings appear to be sufficiently robust to withstand two 
degrees of misalignment prior to assembly. It was also reported that fittings that performed the most 
poorly were most sensitive to under-torque and contamination (scoring of the surface). Both the A/N 
and Swagelok fittings appeared to be sensitive to under-torque and surface scratches. However, 
appropriate inspection and assembly procedures and post-assembly acceptance testing can mitigate 
both of these sensitivities. 

9.1.0.3 - Summary of Historical Data Review 

MS-33656 threaded couplings show an inherent robustness if properly assembled, acceptance tested, 
leak checked and other appropriate checkouts are performed. Even though these test series do not 
constitute a qualification of these threaded fittings, they certainly demonstrate that the MS-33656 
threaded coupling design provides adequate sealing integrity for the types of environments that the 
CALIPSO Proteus bus could be exposed to during its processing and flight mission. 

9.1.1 - CALIPSO Proteus Bus Fitting Assembly 

The torque level indicated by a gauge or wrench during fitting assembly does not represent actual 
clamping force at the sealing surface. In some cases, clamping force may not be sufficient to 
effectively seal a fitting, even though the B-nut is torqued to the specified level. Thread binding or 
physical interference with the wrench head can result in such a “false torque” condition. Mechanical 
fittings must be lubricated slightly to prevent galling and minimize the possibility of false torque. 
Quantity and location of lubricant must be controlled to ensure not only that it is applied but also that 
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it is applied only to moving parts and not to a sealing surface. Lube on a sealing surface may fill a 
scratch or other discrepancy allowing a fitting to pass leak check, only to be washed away or 
dissolved in the presence of liquid propellant creating a void that leads to a leak. CNES has indicated 
that lubricants were used in the assembly of the Proteus bus, but NESC was not provided copies of 
assembly procedures or specific data to indicate where, or in what quantities the lubricants were 
applied. 

As an overarching statement, any procedure review or procedure development performed in response 
to the following eleven (1 1) NESC requirements (‘R’) should consider not only engineering content, 
but also the clarity or “workability” of the procedure from a human factors perspective. That is, care 
should be taken to ensure the procedures clearly convey the author’s intent without ambiguity that 
could confuse the operator and lead to an unintended outcome. 

NESC-R-001 - Program shall demonstrate that Alcatel training and/or assembly documentation 
provided for proper lubrication of fluid fittings during assembly. Assembly procedures shall 
clearly delineate the type, quantity and location where lubricant was applied and ensure sealing 
surfaces were kept dry and free of any contaminant. 

Fittings must be visually inspected before assembly to ensure no discrepant condition exists that 
might lead to leakage. Damaged threads, burrs or machining marks may cause galling and 
subsequent false torque. A contaminant on a sealing surface may not be detected during leak checks, 
but be washed away or dissolved in the presence of liquid propellant creating a void that leads to a 
leak. NESC was not provided copies of assembly procedures documenting Proteus bus pre-assembly 
inspections. 

NESC-R-002 - Program shall demonstrate that Alcatel training and/or assembly documentation 
provided for a visual inspection of fluid fittings prior to assembly. Assembly procedures shall 
ensure components had no visible defects and sealing surfaces were clean and dry. 

9.1.2 - Material Compatibility 

Fault tree assessment highlighted the potential for component failure as a result of material 
incompatibility. There was some conflict among the various sources consulted concerning the 
compatibility of nickel used in the MS-33656 fitting conical seals and hydrazine 12,13,14 ’ 15 . Materials 
experts at WSTF were consulted who indicated that decomposition of hydrazine when exposed to 
nickel is accelerated at temperatures above 212° F 16 , but the small amount of surface area exposed in 
this application was insignificant to make decomposition a concern. The possibility of corrosion 
exists in the long-term, but it should not lead to leakage resulting in personnel exposure in the 36-day 
period under assessment. The fact Voi-Shan seals are not plated is also favorable in this regard. 
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However, since there were some lingering questions regarding compatibility and no evidence Alcatel 
conducted any definitive testing before incorporating nickel seals in the design, NESC elected to run 
a series of independent tests to ensure the seals and propellants were compatible. Aerojet was 
commissioned to conduct an accelerated aging test of the Voi-Shan nickel seals at elevated 
temperature and pressure, along with a room temperature “beaker soak test”. The accelerated test 
will yield quick results, while the room temperature test will serve as a control to verify any positive 
evidence of decomposition is not due only to a temperature/pressure environment unlikely to be 
experienced by the spacecraft. Complete details of the Aerojet testing are included in Appendix E, 
and results are provided in Addendum 1 to this report. 

9.1.3 - Post-Assembly Leak Checks 

Leak checks provide confidence fluid fittings have been properly assembled and validate the overall 
integrity of the joints. They must be conducted at flight pressure, using media no more viscous than 
the propellants themselves and instrumentation suitable for detecting leaks at the smallest allowable 
level. Given the relatively low internal volume of the CALIPSO spacecraft and Delta-II launch 
vehicle fairing, hydrazine leakage at a detectible level may result in an accumulation that violates the 
OSHA PEL of 1 ppm during the 36-day period between propellant servicing and launch. The 
industry- standard approach to such situations is to conduct leak checks at flight pressure with helium 
using a mass spectrometer as a detector. Helium leak checks provide significant margin 
(approximately three orders of magnitude) over liquid hydrazine leakage. Therefore, a system 
verified leak tight with helium (<10‘ 6 scc/sec) will be leak tight for hydrazine unless a sufficient 
upsetting event occurs to change the status of the fitting 7 . 

CNES has indicated helium leak checks of the Proteus bus were conducted on a fitting-by- fitting 
basis after initial assembly. Total system leakage will be measured with an encapsulated helium 
mass spec before integration of the propulsion bus and again after environmental testing of the 
spacecraft. Specified limit for these tests is 8.4xl0~ 5 scc/sec 17 . A final 12-hour decay test will be 
performed at the launch site before propellant servicing. NESC was not provided any other details 
regarding the leak test methods, specifications (including derivation of the 8.4xl0" 5 scc/sec limit), or 
detection equipment to be used for these tests. Bagging and long duration mass spectrometer 
measurements at both high and low pressure would provide maximum confidence that fittings do not 
have small but growing defects that could eventually leak hydrazine 7 . 
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NESC-R-003 - Program shall demonstrate that the Proteus bus mechanical fittings are rigorously 
tested using techniques adequate to validate system integrity. Leak check procedures shall specify 
test method, equipment to be used, media, test pressure and allowable leak rate. 

While CNES indicated spacecraft environmental tests would simulate qualification-level vibration 
and thermal loads, NESC was not provided specific data describing the test series. If the acceptance 
test loads envelope shipping, transport and handling loads expected from propellant servicing through 
launch, the post-environment test leak check will serve not only to certify the assembly for the 
expected flight environment, but also as an effective screen for any fitting that may have passed 
initial leak checks at low (false) torque. During the site visit, VAFB relayed that the highest shock 
loading recorded during transport of a spacecraft was 0.6 g’s. By comparison, the low frequency 
Delta II launch environment is 40 g’s with high frequency response up to 2,500 g’s 18 . Acceptance 
testing to these or higher levels would certainly envelope the expected ground processing loads. 


NESC-R-004 - Program shall demonstrate that thermal and vibration loads applied to the 
spacecraft during environmental tests envelope conditions it will experience from servicing 
through launch. 


9.1.4 - Handling Environment 


Fluid fittings could be loosened if subjected to significant internal pressure or thermal transients. The 
period of highest vulnerability is during dynamic testing, especially propellant servicing, when 
pressures are cycled and the potential for flow-induced vibration exists. There is no indication that 
CALIPSO Proteus bus fittings will be subjected to cyclic thermal or transient pressures significant 
enough to cause leakage, and the induced vibration potential is minimal given the short line lengths 
and low flow rates involved. However, since the CALIPSO servicing procedures were not available 
for review, NESC was unable to assess controls placed on temperature, pressure and flow transients 
during hydrazine loading. 

NESC-R-005 - Program shall demonstrate that servicing procedures adequately control 
temperature, pressure and flow rates to minimize the potential for leakage. 


Even with all controls in place, the possibility of leakage still exists. Consequently, the program must 
take all reasonable precautions to ensure the spacecraft is monitored and personnel can be safely 
evacuated in the event of a leak. Industry-standard measures include a mix of fixed and portable 
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vapor detectors capable of monitoring in the appropriate range, area-warning systems and fixed 
control areas limiting the number of personnel with access to the spacecraft. 


A site visit to VAFB was performed on December 17, 2003, to review the two potential payload 
processing facilities that will be used for CALIPSO and the Delta II launch pad “white room.” A 
map of VAFB locating the various facilities is included as Appendix D. While the Astrotech facility 
was toured, the Spaceport Systems International (SSI) facility was under a security lockdown and 
was inaccessible. Hydrazine detectors used in the Astrotech facility can resolve leaks down to 0.001 
ppm and typically are calibrated and set to sense at 0.005 ppm or one half of the ACGIH TLV. The 
Astrotech fixed detectors are Zellweger Analytics SPM line powered units with 0.005/0.010 ppm gas 
calibration keys while the portable units are SPM Z purge monitors with 0.005/0.010 ppm gas 
calibration keys. Both audible and visual alarms are tripped at 0.005 ppm and the automated 
response system commands roof louvers open and air exhaust fans to maximum capacity. Portable 
detectors are used at the beginning of every work shift to sweep the area for leaks before personnel 
are allowed to enter. A drain trench completely encompasses the area where CALIPSO will be 
fueled and serviced, and can easily capture the 30 kilograms (approximately 8 gallons) of hydrazine 
in the Proteus system. Similar detection schemes with alarms are used at the pad white room 6 . 


The Astrotech payload processing facility fire protection system incorporates dry- and wet-pipe 
deluge systems designed to meet code requirements while protecting hardware from damage caused 
by inadvertent activation 19 . The facilities are equipped with UV and IR detectors for continuous 
monitoring of high-hazard areas as well as ceiling-mounted smoke/heat detectors. Hydrazine sensors 
have fire alarm set points at one quarter the lower explosive limit (i.e., % x 4.7 or 1.175 percent 
hydrazine in air). These alarms communicate with the base emergency response units. If SSI is 
selected to process CALIPSO, the project should verify the SSI detectors and alarms meet or exceed 
the capabilities stated above for the Astrotech facility. 


Post-servicing operations in the vicinity of the CALIPSO spacecraft will be tightly controlled. 
“Amber light” operations will be in effect in the payload processing facility and at the SLC-2 launch 
pad white room. Per memo from the Air Force 30 th Space Wing 20 , “A flashing amber light indicates 
a hazardous operation is in progress in the controlled area. Non-essential personnel shall be cleared 
from the controlled area. Personnel shall not enter without permission from the safety official or in 
the absence of the safety official the entry control authority. Only mission essential personnel will be 
allowed near the spacecraft, all preventive measures will be instituted, facilities will be verified 
acceptable to handle a maximum credible spill and emergency response will be available and on 
call”. 
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In the judgment of the NESC assessment team, the mix of hydrazine vapor detectors, fire detection 
and suppression equipment and personnel controls are adequate for conducting safe operations in 
vicinity of the CALIPSO spacecraft. 


NESC-R-006 - Program shall verify that the controls at the processing facility and launch pad 
identified above are in place to monitor for leakage from the time hydrazine is loaded until final 
closeout for launch. Additionally, the program shall verify that spacecraft operations are 
minimized after hydrazine loading, and that provisions are made for area securing and the rapid 
evacuation of personnel should a leak develop. Further, the program shall coordinate with all 
other payload/Delta II processing personnel to ensure the program ’s approach for minimizing 
personnel exposure to potential hazards is properly integrated. 


9.2.0 - Thruster Leakage 


Thrusters selected for the Proteus bus are designed with normally closed series-redundant solenoid- 
actuated flow control valves manufactured by Moog. The thrusters are of a mature design. A 
schematic of the valve is depicted in Figure 4. 
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Figure 4. Moog Dual Seat Dual Servo Thruster Valve 
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NESC concludes the potential for external leakage from the thrusters either internally (across the 
control valves) or externally (thruster casing or seal) poses acceptable risk to personnel providing the 
program conducts an adequate pre-servicing leak check of each valve. While the program did 
indicate such testing was planned, NESC was not provided a specific description of the test or its 
pass/fail criteria. 


NESC-R-007 - Program shall demonstrate that pre-servicing thruster leak checks will be adequate 
to validate system integrity. Leak check procedures shall test each valve independently and shall 
specify test method, equipment to be used, media, test pressure and allowable leak rate. 


During a site visit to Aerojet Space Propulsion, an issue with Moog thruster valves similar or 
identical to the Proteus valves came to light. A manufacturing process change by Moog resulted in a 
recall investigation on suspect serial number valves 21 . The program was notified of this and was 
working to clear the CALIPSO Proteus bus valve set. 


NESC-R-008 Program shall verify that the Proteus Moog valves on CALIPSO do not have 
defective plunger assemblies. 

9.3.0 - Thruster Inadvertent Firing 

The Proteus thruster firing circuit incorporates a number of controls to ensure valves are not 
inadvertently opened causing a thruster to fire. NESC concurs the controls are adequate, but 
recommends further steps be taken to positively preclude the possibility of an inadvertent command 
during periods of dynamic testing, especially power-up. A schematic of the thruster wiring circuit is 
shown in Figure 5. It is worth noting that the Astrium specification sheet for the thruster lists 
nominal flow rate at 0.44 grams per second. Even with all four (4) thrusters firing at nominal flow 
rate, it would take 4.7 hours to drain the 30 kilograms of hydrazine in the propellant tank. 
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Figure 5. Thruster Circuit Schematic with New Test/Arm Plugs 
(PM refers to spacecraft processor module) 


NESC-R-009 - Program shall demonstrate that test procedures verify relays 16 and 1 7 are open 
before power is applied to the spacecraft. Since the design incorporates latching relays, 
verification of the last stable state by data retrieval or written record is acceptable. 


NESC-R-010 - Steps for inserting and removing test/arm plugs shall be explicitly called out in the 
ground processing timeline. Final installation for flight shall occur as late as possible; until that 
time, plugs shall only be installed as required for thruster valve testing. 


NESC-R-011 - Program shall verify that all thruster firing circuit inhibits function as designed. 
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10 Conclusion 

It should again be noted that key CNES information requested for this assessment through the GSFC 
Program Office was not provided (ref. Appendix A). This fact limited the review team’s ability to 
draw conclusions based on objective evidence and formed the basis for many of the requirements. At 
this time, the NESC cannot objectively conclude that the Proteus bus as designed poses either 
acceptable or unacceptable risk to personnel. The Program must adequately address all eleven (11) 
requirements stated in this report before the NESC can conclude personnel risk is acceptable. These 
requirements call for review of CNES assembly and acceptance test procedures and verification that 
the planned acceptance testing and integrity checks are performed by CNES before hydrazine is 
loaded into the system. Further, verification of the planned operational controls (e.g., leak detection, 
alarms, installation of thruster arm plugs, personnel controls and minimizing spacecraft operations 
once loaded) are required to mitigate the risks to an acceptable level. Aerojet conducted a series of 
tests on the compatibility of hydrazine with the Voi-Shan nickel conical seals. These test results are 
documented in Addendum 1 to this report. 

The expected response from the CALIPSO program to the NESC will be an action plan indicating 
how the program will implement the eleven (11) NESC requirements using their in-line engineering, 
operation and safety organizations. NESC will approve the action plan and determine the adequacy 
of the Program’s responses. (Refer to Addendum 8) . As originator of the actions, NESC will provide 
status (open or closed) on each requirement at the appropriate CALIPSO milestone review prior to 
hydrazine loading. The Program should use Appendix C as a guide to address the NESC’s 
requirements. 


11 Minority Report 

The NESC assessment team observed that there is no isolation valve downstream of the CALIPSO 
propellant tank. The GRC members were of the opinion that the program needed to address this issue 
in response to a specific NESC recommendation and offered the following: 

“The lack of an isolation valve in the Proteus bus design maximizes the potential for 
loss if any one of the three hazardous events were to occur, since there would then be 
no expedient means to stop the flow of hydrazine from the propellant tank. As a result, 
the worst-case failure effect is that most of the hydrazine in the propulsion system 
would be released, possibly causing a catastrophic event (personnel injury or fire). 

There is no evidence that a formal risk assessment was performed to address these 
three hazardous events related to the design decision to omit an isolation valve”. 
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“ Minority Opinion Recommendation - Program should perform or make available 
a formal risk assessment to address the three hazardous events related to the design 
decision to omit an isolation valve. As part of including an isolation valve in the 
design, this assessment should consider the replacement of the mechanical fitting 
closest to the tank with a welded joint. ” 


Two NESC Review Board (NRB) members concurred with including this recommendation in the 
final report. The remainder did not, however, so by Board consensus it was rejected. While a 
thorough risk assessment early in the design process might have led to a different design solution, an 
assessment performed today would not reduce the potential for leakage from the fittings or thrusters 
and thus would not help mitigate the risks associated with the current design. Instead of 
incorporating the suggested recommendation, the Board ensured the lessons learned from this study 
and documented in Section 12 highlighted sound design solutions and underscored the need for 
thorough risk assessments early in the planning of any project. 


12 Lessons Learned 

Project managers should strive to ensure issues are surfaced and resolved, through independent 
assessment if necessary, early in the design process so technical changes can be effected with fewer 
cost and schedule implications. Thorough risk assessments must be performed to arrive at a 
configuration that presents the overall minimum risk to personnel, the mission and the environment. 
Such assessments should be well documented, approved through a formal process, and made 
available for reference should questions arise as a project proceeds. 

When NASA is involved in missions with outside partners, the level of NASA insight and influence 
on non-NASA hardware design, verification and acceptance testing should be documented, clearly 
communicated, and carried as a project risk to be tracked. There was clearly confusion over certain 
safety requirements among the organizations involved in CALIPSO. The roles of various in-line and 
independent safety organizations should be clearly defined and their expectations documented as 
project requirements. Projects should then act to meet these requirements or, when warranted, 
process waivers with rigorous, documented, technical rationale. 

Properly welded fluid connections are inherently more reliable than mechanical fittings and should be 
incorporated in fluid propulsion designs employing hazardous commodities whenever possible. This 
requirement should be reflected in appropriate Agency-level design standards and variance accepted 
only when accompanied by appropriate risk trades and supporting technical rationale. 
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Since lock wire does not prevent torque relaxation, it cannot be relied upon as a secondary locking 
device to prevent fluid fitting leakage. NASA or industry should spearhead development of a 
redundantly-sealed fluid fitting with an integral locking feature that, once engaged, will positively 
preclude loss of clamping force at the sealing surfaces. Ramped, inter-locking teeth between the 
inside rear of the B-nut and back of the tube end might serve this purpose if the ramp angle and teeth 
were sized to prevent nut rotation and loss of axial load with the fitting at full torque (ref. Nord-Lock 
Bolt Securing System, Nord-Lock AB, Mattmar, Sweden, www.nord-lock.com) . 
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Propellant Valve with a Defective Plunger Assembly”, December 12, 2003. 
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Appendix A. NESC CALIPSO Assessment Action Item List 

Calipso Project Assessment Actions 


Update 02-03-05 


No ECD Description Status / Comments Actionee 


1 

CLOSED 

Provide a briefing summarizing project background and issues 

3-Nov-03 

■ Action assigned 

Calipso Project 




6-Nov-03 

■ Complete 



2 

CLOSED 

Provide a briefing summarizing safety issues with Calipso design 12-Nov-03 

■ Action assigned 

Goddard Safety 



13-Nov-03 

■ Complete 



3 

CLOSED 

Provide detailed mechanical fitting configuration data including 
part numbers, materials, torque specifications 

6-Nov-03 

■ Action assigned - due Nov 24 Calipso Project 




24-Nov-03 

■ Should be able to answer this with information available in 
various documents, visits to Alcatel, etc. Data to be provided by 
Nov 28. 




25-Nov-03 

MSPSP contains some data 




1 -Dec-03 

CNES provided more details 




15-Dec-03 

CNES provided material and wall thickness of tubing 


4 CLOSED in part Provide mechanical fitting qualification and acceptance test data. 6-Nov-03 ■ Action assigned - due Nov 24 Calipso Project 


24-Nov-03 ■ SOHO qual test data is identical to that used for Calipso. SOHO 

data provided. Need Calipso acceptance test data. 


5 

CLOSED in part Provide detailed mechanical fitting installation procedure 

including alignment verification, thread lubrication, and torque. 

6-Nov-03 

■ Action assigned - due Nov 24 Calipso Project 



24- Nov-03 

25- Nov-03 

■ Data requested of CNES Nov 24. 
Jim Free provided some details 



1 -Dec-03 

CNES provided some details but no procedures for review 



22-Dec-03 

Requested grease application (how much and were) on 12-4-03 - 
no response provided 
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Calipso Project Assessment Actions 


Update 02-03-05 


No ECD 

Description 

Status / Comments 

Actionee 

6 CLOSED in part 

Provide detailed fluid system configuration drawing showing 
component locations (tank, lines, fittings, brackets, thrusters), 

6-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 


line routing, and line lengths 

24-Nov-03 

■ Data requested of CNES Nov 24. 




25-Nov-03 

Alcatel will not provide this detail 




16-Dec-03 

CNES provided one drawing with thruster locations - no tubing or 
clamp layout dimensions. 



7 

CLOSED 

Provide detailed summary of mechanical fitting leak check 
procedures, specifications, and test results 

6-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 




24-Nov-03 

■ Data requested of CNES Nov 24. 





25-Nov-03 

Jim Free email provided some detail 





1 -Dec-03 

CNES provided some details 





15-Dec-03 

CNES provided detailed summary of procedures, no pass/fail 
criteria or test results from subassembly checks to date. 





12-May-04 

Details provided by Alcatel during site visit. 



8 CLOSED Provide summary of environments to which propulsion system 6-Nov-03 ■ Action assigned - due Nov 24 Calipso Project 

will be exposed following hyper servicing, to include vibration, 
pressure, and thermal. 

24- Nov-03 ■ Once fueled, the only environmental change is vibration from the 

move to the pad. Process timeline to be provided by Nov 28. 

25- Nov-03 Jim Free provided schedule with limited details and information 

on processing facility environment 
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Calipso Project Assessment Actions 


Update 02-03-05 


No 

ECD 

Description 

Status / Comments 

Actionee 







9 

CLOSED 

Provide mass properties of key propulsion system components, 
esp. tank, lines, and thrusters. 

6-Nov-03 

24- Nov-03 

25- Nov-03 
5-Dec-03 
16-Dec-03 

■ Action assigned - due Nov 24 

■ Data requested of CNES Nov 24. 

MSPSP provides some details 

Don Porter provided thruster mass and dimensions 
CNES provided estimated mass of tank, lines and thrusters 

Calipso Project 

10 

1 -Dec-03 

Determine whether mechanical fitting qual tests are adequate to 
address expected environment. 

6-Nov-03 

22-Dec-03 

■ Action assigned - due Dec 1 
Waiting on CNES data package 

NESC Team 


11 

CLOSED 

Identify additional testing required to assess suitability of 
mechanical fittings for use on Calipso spacecraft. 

6-Nov-03 

■ Action assigned - due Dec 1 

NESC Team 




17-Dec-03 

Insufficient configuration data to make vibe/leak tests traceable 
to flight 


12 

CLOSED in part 

Provide thruster qualification and acceptance test data. 

6-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 




24-Nov-03 

■ Data requested of CNES Nov 24. Data presently available to be 
provided by Nov 28. 





15-Dec-03 

CNES assembling data package for mail delivery 





12-May-04 

Thruster leak & thermal/vibe details provided during Alcatel 
site visit. 


13 

1 -Dec-03 

Determine whether thruster qual tests are adequate to address 
expected environment. 

6-Nov-03 

■ Action assigned - due Dec 1 

NESC Team 




22-Dec-03 

Waiting on CNES data package 


14 

1 -Dec-03 

Identify additional testing required to assess suitability of 

6-Nov-03 

■ Action assigned - due Dec 1 

NESC Team 


thrusters for use on Calipso spacecraft. 
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Update 02-03-05 

Calipso Project Assessment Actions 


No ECD 

Description 

Status / Comments 

Actionee 

15 CANCELLED 

Review Calipso propulsion system with respect to EWR 127-1 6-Nov-03 ■ Action assigned - Due Dec 5 

requirements. 

22-Dec-03 Non-Disclosure Agreement delays - cancelled action 

Aerojet 


16 

CLOSED 

Provide a copy of the tailored EWR 127-1 requirements 

13-Nov-03 ■ Action assigned 

Goddard Safety 




17-Nov-03 ■ Closed. Data provided. 



17 

CLOSED 

Provide contacts at SSI and Astrotech 

13-Nov-03 

■ Action assigned 

Goddard Safety 




17-Nov-03 

■ Closed. Contact info provided. 



18 

CLOSED 

Provide questions for Alcatel site visit. 

13-Nov-03 ■ Action assigned 

NESC Team 




14-Nov-03 ■ Closed. Questions forwarded to Calipso Project. 



19 

CLOSED in part Provide electrical drawings detailing operation of test and arm 

14-Nov-03 

■ Action assigned - due Nov 24 Calipso Project 


plugs. 

24-Nov-03 

■ Data requested of CNES Nov 24. 



25-Nov-03 

Drawing provided w/o operations details 



22-Dec-03 

Julie Schneringer (KSC resident office at VAFB) provided 
detailed ground processing timeline for Jason 1. Still need point 
where arm plugs are installed (added after Jason) 



12-May-04 

Details provided during Alcatel site visit. Test & arm plugs 
installed for last time before shipment to VAFB. 


20 

CLOSED 

Provide a copy of the Jason-1 servicing (ML 902, 908, 920, 934 & 14-Nov-03 
950) and emergency offload (ML 925 & 926) procedures. Note: 

Calipso procedures available no earlier than 6 months before 
launch (June 2004). 

■ Action assigned - due Nov 24 

Calipso Project 



24-Nov-03 

■ Data requested of CNES Nov 24. 
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Calipso Project Assessment Actions 


Update 02-03-05 


No ECD 

Description 

Status / Comments 

Actionee 



21 

CLOSED 

Provide a copy of the Project MSPSP. 

14-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 




24-Nov-03 

■ Copy available in LiveLink at LaRC. Passwords to be provided 
by Nov 28. 





25-Nov-03 

Jim Free provided electronic copy 



22 

CLOSED 

Provide a ground operations timeline detailing tasks performed 
and personnel access from spacecraft servicing through launch. 

14-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 




24- Nov-03 

25- Nov-03 
17-Dec-03 

■ Data to be provided by Nov 28. 

Jim Free provided schedule with limited details 

Julie Schneringer (KSC resident office at VAFB) provided 

detailed ground processing timeline for Jason 1. 



23 

CLOSED 

Provide data indicating how spacecraft is accessed for propellant 

14-Nov-03 

■ Action assigned - due Nov 24 Calipso Project 



servicing. 

24-Nov-03 

■ Data to be provided in coordination with KSC. Available data to 
be provided by Nov 28. 




25-Nov-03 

Jim Free email with pictures and details 


24 

CLOSED 

Provide data, including photographs if available, detailing 
accessibility of mechanical fittings and thrusters after installation 

14-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 



in the spacecraft. 

24-Nov-03 

■ Available photos will be provided by Nov 28. New pictures taken 
during Alcatel site visit in November will also be provided. 





25-Nov-03 

Photos provided by Jim Free 


25 

24-Nov-03 

Provide safe life, stress, and fracture mechanics data for 

14-Nov-03 

■ Action assigned - due Nov 24 

Calipso Project 


propellant tank. In particular, since the tank presumably captures 
the elastomeric bladder in a hemispherical weld joint, the fracture 
mechanics analysis must include an assessment of the residual 
stresses at this location. 
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Calipso Project Assessment Actions 


Update 02-03-05 


No 

ECD 

Description 

Status / Comments 

Actionee 

26 

CLOSED 

Prepare an interim summary of NESC assessment for 
presentation to Calipso Project. 

17-Nov-03 ■ Action assigned - due Dec 8 

5-Dec-03 Provided status briefing to GSFC Deputy Center Director 

NESC Team 







27 

CLOSED 

Prepare fault trees for use as assessment tools: fitting leak, 

19-Nov-03 

■ Action assigned - due Nov 28 Robinson - GRC 



thruster leak, thruster inadvertent firing. 

24-Nov-03 

■ Preliminary fault trees have been prepared and will be forwarded 
for comment. 




25-Nov-03 

Preliminary fault trees forwarded for comment. 




18-Dec-03 

Updated drafts of fault trees and mitigation provided 




22-Dec-03 

Draft hazard analysis provided for comment 




23-Dec-03 

Final fault tree, mitigation and report text provided 


28 CLOSED Determine how quickly Aerojet could set up a vibration test. 21 -Nov-03 ■ Action assigned - due Nov 25 Aerojet 


25-Nov-03 ■ Vibration lab has some openings, and testing could be performed 


in the month of December. Need specific requirements before 
schedule can be finalized. 







29 

CLOSED 

Provide a ROM cost for compatibility and vibration tests. 

21 -Nov-03 ■ Action assigned - due Nov 25 

25-Nov-03 ROM Cost Delivered 

Aerojet 
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Appendix B. CALIPSO Fault Tree Analysis 


Final Fault Trees for Independent Assessment of CALIPSO 
By: Ed Zampino and Bill Schoren at NASA Glenn Research Center 
January 8, 2004. 


Three Fault Trees were developed for the Independent Assessment of CALIPSO. 

The three Undesired Top Level Events were: 

1 . Leakage of Mechanical F ittings 

2. Inadvertent opening of thmster valves L-36 days to Launch 

3 . Leakage of Thmster Control Valve 

References 

Presentation Slides from NESC Briefing dated November 5, 2003. 

Presentation Titled: “Inadvertent Actuation of Valves,” Slides NESC-CALIPSO PROPULSION, DJP-7 
and DJP-9. Also, “Design Sketches & Satellite Exploded Views,” Slides NESC-CALIPSO 
PROPULSION, DJP-2 and DJP-3 . 

PIC-LB-0-AN-0060-ASPI, Issue 01, from ALCATEL SPACE, Chapter 6.1.1 - Page 3, 4, and 5. 
PIC-LB-O- AN-0060- ASPI, Issue 01, from ALCATEL SPACE, Page 43. 

SOHO PROJECT, - JCWG #4 - PROPULSION SYSTEM ISSUES, SCREW JOINT QUALIFICATION 
STATUS-REPORTS- GSE SPECIFICATIONS. Memorandum 92323EST0392, R. Brandt. 1992. 

AIAA 96-3116, “Experiments on the Robustness of Separable Fittings” S. M. Georgian et al, July 1996. 

Report- “REQUESTED INFORMATION REGARDING THE PROTEUS BUS PROPULSION 
SYSTEM,” December 2003. 

CALIPSO MS Fitting Leak Test Summary Report, Prepared by D. Asato, Propulsion Branch 597, NASA 
Goddard Space Flight Center 

Moog Space Products Division Monopropellant Thmster Valve Specification Sheet for Model 51-184. 
This analysis is based on the following assumptions: 

1. Leakage of Mechanical Fittings 

a. The fittings will not go through coupling/uncoupling/re-coupling cycles during the ground test 
and pre-launch checkout phases. This type of wear will not be significant. 

b. The coupling of the fittings, if done improperly , can cause damage that may lead to leaks. 

c. If the couplings possess stmctural defects such cracks, major internal flaws, or they are 
produced out of a material that was not specified in the design, this may result in external 
leakage. 

d. Excessive Temperature from some source may cause the fittings to expand and be under strain. 
This could cause fittings to crack (or fail) allowing leakage of N2H4. Although this condition is 
highly unlikely it has been included in the fault tree. 
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Appendix B. CALIPSO Fault Tree Analysis 


e. The fittings have to be designed to take the stress (forces) exerted from within by internal fuel 
line pressure (pressure of the N2H4). 

f. The fittings must be designed to withstand forces from launch vibration. There are other events 
that can expose the fittings to shock such as equipment collision. 


2. Inadvertent opening of thruster valves L-36 days 


a. During ground testing, input power to the enabling circuits will be provided by Ground Support 
Equipment (GSE). During the ground testing/processing, GSE will provide power only when it is 
necessary to check out required system functions. Otherwise, power will not be provided. 

b. The only way that power can be provided to the spacecraft (and the thruster actuation circuits) is 
through input ports that only connect to the GSE. 

c. When input voltage is provided to the actuation circuit, a signal (tele-command) is sent to the first 
relay that energizes the relay. 

d. When a second tele-command is sent to the second relay, the relay is energized. 

e. A software command from the Processor Module (PM) orbit control mode software application is 
required to provide power to the Drivers 1 and 2. This action enables power to reach the solenoid 
valve coils in both thruster valves. (Ref. Slide DJP-4) 

f. When the Arm plugs are removed from the circuit leading to the thruster valve solenoid coils, this 
action cuts off the physical path (breaks the circuit) by which power can be provided to the 
solenoid coils. 

g. Even if the top (first) thruster valve coils are energized and the valve opens, this does not 
constitute an inadvertent firing of the IN Thruster. Both valves must open for a thruster firing to 
occur. 

3. Leakage of Thruster Flow valve . 

a. The thruster valves are not disassembled following their initial fabrication, QC Testing, and 
shipping from Moog Corporation. However, the assembly and testing of the thruster valves, if 
done improperly , can result in an undetected defective seal leading to external leaks. 

b. There is a leak test performed by the valve manufacturer (Moog) and a leak check performed at 
the thruster level of system assembly in Germany. 

If these leak checks are not performed correctly and are ineffective, a defective valve could go 
undetected and be included as a part of CALIPSO. 

c. If the welds, seams, metallic envelope, and outer casing possess structural defects such cracks, 
major internal flaws, or they are produced out of a material that was not specified in the design, 
this may result in failure: external leakage failure mode. Defective valve assembly could also 
lead to internal leakage. Failure of the valve to close properly (the armature/poppet assembly 
does not close against the valve seat) could be caused by a defective valve spring, 
contamination lodged between the poppet and seat, or a defective valve seat. 
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d. Excessive Temperature from some source may cause the seams or joints in the valve to expand 
and be under strain. This could cause parts to crack (or fail) allowing leakage of N2H4. 
Although this condition is highly unlikely it has been included in the fault tree. 

e. The thruster valves have to be designed to take the stress (forces) exerted from within by 
internal fuel line pressure (pressure of the N2H4). 

f. The thruster valves must be designed to withstand forces from launch vibration. There are other 
events that can expose the valves to shock such as equipment collision. 
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Appendix C. CALIPSO Fault Tree Mitigation Matrix 
Leakage of Mechanical Fittings 


1/9/2004 


EVENT 

EVENT 

VERIF. 

RECOMMENDED MITIGATION 

NUMBER 

DESCRIPTION 

METHOD 

ACTION 

1-0 

Failure to contain N2H4 due to improper 
coupling 



1-0-1 

Procedural Error in Assembly 


Refer to NESC-R-001 and NESC-R-002. 

1-0-1-1 

Thread and shoulders not proper greased 



1-0- 1-2 

Thread and shoulders not greased 



1-0- 1-3 

Conical seal is not included in assembly 



1-0-1-4 

Conical seal is seated in skewed position 



1-0-1-5 

Applied torque is out-of-spec 



1-0- 1-6 

Failure to apply torque 



1-0-1-7 

Pipe, seal, or threads contaminated 



1-0-1-8 

Failure to apply specified settling period for grease 



1-0-1-9 

Re-torque is out-of-spec 



1-0-2 

Testing fails to detect leakage during processing & 
integration 


Refer to NESC-R-003. 

1 -0-2-1 

System Level Proof Test fails to detect leakage 



1 -0-2-2 

System Level Leak Test fails to detect leakage 



1-0-2-3 

Leak Check at VAFB fails to detect leakage 



1 -0-2-4 

Leak Check after fueling fails to detect leakage 



1-1 

Failure to contain N2H4 due to Structural 
Failure 



1-1-1 

Cracks in pipe ends propagate to critical size 


Refer to NESC-R-002 and NESC-R-003. 

l-l-l-l 

Cracks, defects, or weaknesses formed in the material 



l-l-l-l-l 

Material forms cracks when machined 



1-1-1-1-2 

Defective material selected for assembly 



1-1-1-2 

Stress is exerted on pipe end from fuel pressure* 



1-1-2 

Structural failure caused by stress-corrosion 
cracking 

Analysis 

Materials assessment performed to preclude use of stress 
corrosion susceptible materials. Closed - Reference PIC-LB-0- 


C-l 

* - Expected conditions 


Appendix C. CALIPSO Fault Tree Mitigation Matrix 
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1/9/2004 


EVENT 

NUMBER 

EVENT 

DESCRIPTION 

VERIF. 

METHOD 

RECOMMENDED MITIGATION 
ACTION 




AN-0060-ASPI Chapter 6.1.1. 

1-1-2-1 

Material selected is susceptible to Stress-Corrosion 



1-1-2-2 

Stress is exerted on pipe end from fuel pressure* 



1-2 

Failure to contain N2H4 due to Temperature 
Changes 

Analysis/ 

Inspection 

Spacecraft temperature controlled to small variations during 
ground processing. Closed - Reference Launch Vehicle ICD 
MDC-01H0074. 

1-2-1 

Materials used have significantly different Coefficient 
of thermal Expansion 



1-2-2 

Temperature variations/cycling occurs* 



1-3 

Failure to contain N2H4 due to Fluid Over- 
pressure 



1-3-1 

Material reacts with N2H4 due to incompatibility 

Analysis 

Material assessment performed to preclude use of materials 
incompatible with N2H4. Closed pending results of Aerojet 
compatibility tests. Reference PIC-LB-0-AN-0060-ASPI 
Chapter 6.1.1. Materials used are compatible with N2H4 
according to MSFC-HDBK-527 rev. F. 

1-3-2 

Improper filling of propulsion fuel system 


Refer to NESC-R-005. 

1-3-2-1 

Undetected Errors occur in Filling Procedure 



1-3-2-2 

Critical GSE used for filling process fails 



1-3-2-3 

Critical GSE for filling process is out of calibration 



1-4 

Failure to contain N2H4 due to physical 
damage 



1-4-1 

Mechanical Fittings damaged by mechanical shock 


Refer to NESC-R-004. 

1 -4-1-1 

Spacecraft dropped during processing 



1-4- 1-2 

Spacecraft collides with an object during processing 
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* - Expected conditions 


Appendix C. CALIPSO Fault Tree Mitigation Matrix 
Leakage of Mechanical Fittings 


1/9/2004 


EVENT 

EVENT 

VERIF. 

RECOMMENDED MITIGATION 

NUMBER 

DESCRIPTION 

METHOD 

ACTION 

1-4-2 

Mechanical Fittings damaged by vibration loads 


Refer to NESC-R-004. 

1 -4-2-1 

Vibration levels during transportation damages fittings 



1 -4-2-2 

Vibration levels during lifting and mounting of 
Spacecraft damages fittings 



1-4-3 

Mechanical Fittings damaged during system 
assembly 


Refer to NESC-R-001, NESC-R-002, andNESC-R-003. 

1-4-3-1 

Technician or Engineer damages coupling by assembly 




error 



1-4-3-2 

System testing fails to detect Leakage 




* - Expected conditions 
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Appendix C. CALIPSO Fault Tree Mitigation Matrix 
Inadvertent Opening of Thruster Valves 


4/19/2005 


EVENT 

EVENT 

VERIF. 

RECOMMENDED MITIGATION 

NUMBER 

DESCRIPTION 

METHOD 

ACTION 

IOTV-1 

Input power is provided to circuit from GSE* 



IOTV-2 

Power to actuate valves reaches drivers 



IOTV-2-1 

1st relay is Energized 


Refer to NESC-009. 

IOTV-2- 1-1 

1 st Relay receives Inadvertent Tele-command 



IOTV-2- 1-2 

Relay Failure (Short) 



IOTV-2-2 

2 nd relay is Energized 


Refer to NESC-009. 

IOTV-2-2-1 

2 nd Relay receives Inadvertent Tele-command 



IOTV-2-2-2 

Relay Failure (Short) 



IOTV-2-3 

Opt-couplers commanded ON by PM orbit Control 
Software 


Refer to NESC-009. 

IOTV-3 

Power provided to solenoid coils for both valves 



IOTV-3-1 

Arm Plug #1 Installed too early before fairing 
installation 


Refer to NESC-R-010. 

IOTV-3-2 

Arm Plug #2 Installed too early before fairing 
installation 


Refer to NESC-R-010. 


Note - After propulsion system filling operations (including Launch Pad operations), inadvertent opening of a pair of thruster valves requires three 
commands. (Three inhibits) These commands are needed to enable the power to reach the solenoid valve coils. (See page 5 Chapter 6. 1 .2 A nn ex 2 to 
HR-1 of PIC-LB-0- AN-0060-ASPI). In addition, the arm plugs for both thruster valves would have to be installed to provide a path for power. 
Moreover, during filling operations, the spacecraft cannot be powered because the spacecraft battery and the Ground Support Equipment are not 
electrically connected to the spacecraft power bus. 


* - Expected conditions 
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Appendix C. CALIPSO Fault Tree Mitigation Matrix 
Inadvertent Opening of Thruster Valves 


4/19/2005 


EVENT 

EVENT 

VERIF. 

RECOMMENDED MITIGATION 

NUMBER 

DESCRIPTION 

METHOD 

ACTION 


2-0 

Failure to contain N2H4 due to Defective Valve 
Assembly 



2-0-1 

Procedural Errors in assembly occur 


Refer to NESC-R-007 and NESC-R-008. 

2-0-1-1 

Seams that should be welded are missed 



2-0-1-2 

Welding performed on seams is defective 



2-01-3 

Material applied to create seals is applied incorrectly 



2-0-1-4 

Use of defective material 



2-0- 1-4-1 

Use of defective material for metallic welded envelope 



2-0- 1-4-2 

Use of defective material for outer casing 



2-0-1-5 

Critical bolts or screws are improperly torqued 



2-0-1-6 

Defective assembly of internal mechanism 



2-0- 1-6-1 

Particles lodge between Armature-poppet Assembly & Seat 



2-0- 1-6-2 

Valve Seal is improperly formed 



2-0- 1-6-3 

Spring fails to close valve when power is removed 



2-0-2 

In-process Inspection Fails to Detect Assembly Errors 


Refer to NESC-R-007 and NESC-R-008. 

2-0-3 

Testing Fails to Detect Leakage after Assembly 


Refer to NESC-R-003 and NESC-R-007. 

2-0-3-1 

Valve Level Leak Test Fails to Detect Leakage 



2-0-3-1-1 

Valve Level Leak Test Equipment Fails 



2-0-3-1-2 

Valve Level Leak Test Equipment Out of Calibration 



2-0-3-1-3 

Valve Level Leak Test Procedural Error 



2-0-3-2 

Thruster Level Leak Test Fails to Detect Leakage 



2-0-3-2-1 

Thruster Level Leak Test Equipment Fails 



2-0-3-2-2 

Thruster Level Leak Test Equipment Out of Calibration 



2-0-3-2-3 

Thruster Level Leak Test Procedural Error 




* - Expected conditions 
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Appendix C. CALIPSO Fault Tree Mitigation Matrix 
Leakage of Thruster Flow Valve 


4/19/2005 


EVENT 

EVENT 

VERIF. 

RECOMMENDED MITIGATION 

NUMBER 

DESCRIPTION 

METHOD 

ACTION 


2-1 

Failure to contain N2H4: Structural Failure 
of Valve 



2-1-1 

Cracks in valve propagate to critical size 


Refer to NESC-R-003 and NESC-R-007. 

2-1-1-1 

Cracks, defects, or weaknesses formed in the 
material 



2-1-1-1-1 

Material forms cracks when machined 



2-1-1-1-2 

Defective material selected for assembly 



2-1-1-1-3 

Cracks or flaws formed in welds from process errors 



2-1-1-2 

Stress exerted from pressure and temperature* 



2-1-2 

Structural Failure caused by Stress Corrosion 
Cracking 

Analysis 

Materials assessment performed to preclude use of stress 
corrosion susceptible materials. Closed - Reference PIC-LB-0- 
AN-0060-ASPI Chapter 6.1.1. 

2- 1-2-1 

Material used is susceptible to Stress-Corrosion 



2-1-2-2 

Stress exerted from pressure and temperature* 



2-2 

Failure to contain N2H4 due to Fluid Over- 
pressure 



2-2-1 

Material reacts with N2H4 due to incompatibility 

Analysis 

Material assessment performed to preclude use of materials 
incompatible with N2H4. Closed pending Aerojet 
compatibility test result. Reference PIC-LB-0-AN-0060-ASPI 
Chapter 6.1.1. Materials used are compatible with N2H4 
according to MSFC-HDBK-527 rev. F. 

2-2-2 

Improper filling of propulsion fuel system 


Refer to NESC-R-005. 

2-2-2- 1 

Undetected Errors occur in Filling Procedure 



2-2-2-2 

Critical GSE used for filling process fails 



2-2-2-3 

Critical GSE for filling process is out of calibration 



2-3 

Failure to contain N2H4 due to physical 
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Appendix C. CALIPSO Fault Tree Mitigation Matrix 
Leakage of Thruster Flow Valve 


4/19/2005 


EVENT 

EVENT 

VERIF. 

RECOMMENDED MITIGATION 

NUMBER 

DESCRIPTION 

METHOD 

ACTION 


damage 



2-3-1 

Valve seal broken by mechanical shock 


Refer to NESC-R-004. 

2-3-1-1 

Spacecraft dropped during processing 



2-3-1-2 

Spacecraft collides with an object during processing 



2-3-2 

Valve seal broken by vibration loads 


Refer to NESC-R-004. 

2-3-2- 1 

Vibration levels during transportation damages valve 



2-3 -2-2 

Vibration levels during lift and mounting of Spacecraft 
damages valve 



2-3-3 

Valve seal broken during system assembly 


Refer to NESC-R-007. 

2-3-4 

Valve seal broken during system test 



2-3-5 

Valve seal broken during maintenance action 



2-4 

Failure to contain N2H4 due to Temperature 
Changes 

Analysis/ 

Inspection 

Spacecraft temperature controlled to small variations during 
ground processing. Closed - Reference Launch Vehicle ICD 
MDC-01H0074. 

2-4-1 

Materials used have significantly different Coefficients 
of Thermal Expansion 



2-4-2 

Temperature variations/cycling occurs* 




* - Expected conditions 
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Appendix E. Aerojet Compatibility Test Report 

Aerojet Evaluation Team 


Dr. Scott Miller, Manager - Systems and Bipropellant Technology 
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Patrick Cabral, Development Engineer 



Appendix E. Aerojet Compatibility Test Report 

Aerojet Test Plan Summary 


• Mechanical Fitting Evaluation Objectives 

- Simulate both valve (CRES male inlet fitting to titanium flared tube) and tank 
(titanium male inlet fitting to titanium flared tube) fitting configurations to the 
best fidelity possible given available CALIPSO information 

- Perform hydrazine soak test simulating pre-launch loaded system duration to 
assess effect of hydrazine on nickel seal material 


E-3 



Appendix E. Aerojet Compatibility Test Report 

Aerojet Test Plan Summary (Cont’d) 


Hot Soak Test of Nickel Seals 

- Place qty 16 nickel seals in hydrazine for parallel exposure test on nickel material only. 
Volume of hydrazine and seal quantity is outlined below. 


Sample Description 

Volume of 
Hydrazine 

QTY of Seals 

Test Duration 

Temperature 

Control 

50 mL 

0 

36-days 

Ambient 

Fitting Exposure 

50 mL 

5 

36-days 

Ambient 

Fitting Exposure at 
Elevated Temperature 

50 mL 

5 

1 0-days 

120°F 

One Seal Exposure 

50 mL 

1 

36-days 

Ambient 

Fitting Exposure with 
Weekly Check 

100 mL 

5 

36-days 

Ambient 


- Perform hydrazine assays before and after testing on all samples; Weekly tests performed 
on 100 mL for duration of test 

- Success criteria for post-test assays (nickel ppm and gas evolution rate) to be discussed 
by team when results are available 
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Aerojet Test Plan Summary (Cont’d) 


• Hot Soak Test of Test Hardware 

- Obtain flight-like mechanical fittings (MS33656-4). CRES and titanium fittings are available. 

- Prepare test hardware approximating portion of CALIPSO system (fittings + tubing) using 
representative tubing material and lengths, and assembled according to CALIPSO procedures 

- Torque fittings to 100% flight torque (including re-tightening schedule), apply torque stripe 

- Proof test at 480 psig (1.5 x MEOP) 

- GHe leak test at 320 psig (MEOP) 

- Load test hardware with N2H4, perform accelerated exposure test representative of 36 days duration 
in Aerojet sea level test chamber (225F for 3.5 days) 

- Obtain pre- and post-exposure N2H4 samples, perform assays 

- Decontaminate, repeat proof and GHe leak tests 

- Check torque strength of unions at thruster location by ensuring it is greater than or equal to original 
torque value 

- Undo thruster fitting and examine nickel seals 

- Examine seals to determine surface effects of nickel and hydrazine interaction. Distribute results of 
seals to team for evaluation and further direction. Success criteria for post-test assays (nickel ppm 
and gas evolution rate) to be discussed by team. 
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Aerojet Test Plan Summary (Cont’d) 
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Appendix E. Aerojet Compatibility Test Report 

Propulsion System Schematic for Test 
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Appendix E. Aerojet Compatibility Test Report 


Hot Soak Test Setup 


• Four fittings to be tested: Two in titanium line, and two CRES at thruster location 

— Thruster fittings simulated for hot soak test due to the uncertainty of the valves acquired. Valves need to function 
properly when exposed to hydrazine for decontamination purposes. 


• Lines filled with hydrazine and stored in oven 

— Temp at 225°F; Line pressure at 320 psig; Duration of 3.5 days 



37° Flare (Ti) 




(All other materials same as above) 



Fittings scored to check 
for movement 
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Hot Soak Test Facility 
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Appendix E. Aerojet Compatibility Test Report 

Aerojet Test Plan Summary (Cont’d) 


Hydrazine Compatibility Test 

• Sample of hydrazine before and after hot soak, and for ambient test in 
chemistry lab 

- Trace metals test 


• Inductively Coupled Plasma (ICP) technique used 

- Nickel levels to 1 ppm 

- All other metals down to ppb 
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Aerojet Test Plan Summary (Cont’d) 



Pressure consoles 



Helium leak detector 


Test Stand/ Vacuum chamber 



Proof/Leak Testing 

• Proof test at 1 .5 X 320 psig 

- Test hardware will be capped on one end and pressurized with GN2. Fitting will 
be snooped to check for leaks 

- GP-TE-016 High Pressure Console to control pressure input 

• Helium Leak Check 

- Fittings tested for leaks at 320 psig with GHe via “bag” isolation and mass 
spectrometer 

- GP-TE-002 Test Stand Bay to control pressure input 

- Mass Spectrometer (Varian Turbo Auto-Test 947) 

• Integrity >= 1X10' 8 scc/sec. (1x10' 6 scc/sec. typical max allowable for acceptance of 
rocket engines) 
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Appendix E. Aerojet Compatibility Test Report 

Aerojet Test Plan Summary (Cont’d) 


• Mechanical Fitting Evaluation - Schedule and Status 

- Obtain all required information or proceed based on assumptions: Complete 

- Gather materials: Complete 

- Prepare and review test plan: Complete 

- Conduct Test Readiness Review: Complete 

- Prepare hot soak test setup: Complete 

- Hydrazine exposure (Hot Soak Test): Complete 

- Hydrazine exposure (Ambient Test Nickel Seals Only): Complete 

- Hydrazine exposure (120°F Test Nickel Seals Only): Complete 

- Final examination and analysis (Hot Soak Test): Complete 

- Final examination and analysis (Ambient Test Nickel Seals Only): Complete 

- Final examination and analysis (120°F Test Nickel Seals Only): Complete 
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Appendix E. Aerojet Compatibility Test Report 

Aerojet Test Plan Summary (Cont’d) 


• Mechanical Fitting Evaluation - Schedule and Status 

- Obtain all required information or proceed based on assumptions: Complete 

- Gather materials: Complete 

- Prepare and review test plan: Complete 

- Conduct Test Readiness Review: Complete 

- Prepare hot soak test setup: Complete 

- Hydrazine exposure (Hot Soak Test): Complete 

- Hydrazine exposure (Ambient Test Nickel Seals Only): Complete 

- Hydrazine exposure (120°F Test Nickel Seals Only): Complete 

- Final examination and analysis (Hot Soak Test): Complete 

- Final examination and analysis (Ambient Test Nickel Seals Only): Complete 

- Final examination and analysis (120°F Test Nickel Seals Only): Complete 
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1.0 INTRODUCTION 

The CALIPSO spacecraft scheduled for a 2005 launch at Vandenberg Air Force Base uses a 
French Proteus bus. The bus propulsion system utilizes a series of mechanical AN type fittings 
instead of welded joints at the propellant tank. thruster and other system interfaces. The NASA 
Engineering and Safety Center (NESC) has performed an investigation of this propulsion system 
to ensure that personnel at Vandenberg will not be in danger while the spacecraft is being 
prepared for launch. Of major concern is the risk of having a mechanical fitting leak, thereby 
exposing personnel to the hydrazine propellant. The spacecraft will be filled with hydrazine for 
36 days prior to launch and a leak of any kind could result in a catastrophic failure. 

One action item of the NESC was to independently investigate compatibility of the mechanical 
fittings with hydrazine for the 36-day exposure period. The metals included in the fittings are 
titanium, steel (CRES 304), and nickel. There have been several investigations with titanium and 
steel to show that they are compatible with hydrazine. A similar literature search of nickel 
compatibility produces contradictory results. 

Outlined in USAF Propellant Handbook AFRPL-TR-69- 149 111 are data relative to the 
compatibility of metals with hydrazine. A class level “A” is given to a metal classified as having 
no limitations for its use in hydrazine. Conversely, a class level 4t D” is given to a metal that is 
completely unsuitable for use with hydrazine. Studies rqiorted in this handout independently 
rank nickel compatibility in hydrazine as a class A or D for a range of testing parameters. 
However, for this application, no finite conclusions could be made whether or not the nickel used 
in this configuration was acceptable or not. The NESC therefore requested that Aerojet perform a 
series of compatibility tests between nickel and hydrazine to investigate this issue. 
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2.0 SCOPE 

A sketch of the mechanical fittings used in this propulsion system can be seen in Figure 1 below. 



Wire Locking 


Figure 1 - Schematic of Mechanical Fittings 


The propulsion system uses titanium tubing welded to titanium threads. Tire adjacent tube is 
flared to a 37° angle with a CRES 304 B-Nut and tube sleeve. A nickel conical seal is secured in 
between the tube ends to ensure a leak tight seal. 

A concern of the NESC was the 36-day exposure period the fitting would experience before 
launch. To test the compatibility of nickel in hydrazine, a series of tests were performed. The 
first test involved making a propulsion system mock up, exposing it to hydrazine and checking 
for traces of nickel after 36 days. Arrhenius equations show that for a 36-day exposure at room 
temperature, an accelerated test can be set up for 3.5 days with the system at 225°F. The second 
set of tests involved placing nickel conical seals in hydrazine with no other metals present. The 
hydrazine samples were placed at room temperature for 75 days to add margin to the 36-day 
exposure time, while a parallel test at 120°F was set up to accelerate the test to 10 days. Again, 
the accelerated test temperature and duration were set up to simulate 36 days of exposure. 

At die conclusion of each test, the test samples were visually inspected for surface changes, and 
the hydrazine was assayed to determine levels of iron, nickel, and other constituents vs. pre-test 
and control samples. 
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3.0 TEST SETUP 

The two separate parallel tests included in this investigation were a hot soak test of a 
representative portion of the propulsion system, and a nickel soak test. 

3.1 Hot Soak Test 

The hot soak test configuration is modeled after the bus propulsion system. Figure 2 below 
shows a rough schematic of half of the CAL IPSO propulsion system. 



Figure 2 - Rough Schematic of Half of the CALIPSO Propulsion System 


To test this configuration, two thruster valves similar to those used in the CALIPSO propulsion 
system were acquired from Moog. However, the valves were development units with minimal 
quality documentation. Due to the risks involved with operating a system with hydrazine at 
elevated pressure and temperature, it was decided that the thruster valves would not be used in the 
hot soak test configuration. A standard CRES 304 male to male tube union was used in their 
place since the valves have a stainless steel body with male threads. The final test configuration 
can be seen in Figure 3 along with the label and corresponding sketch of each fitting. 
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Figure 3 - Test Configuration for the Hot Soak at 225°F With Sketch of Fitting Location 

The assembled test section was then subjected to a proof and helium leak check to ensure the 
fittings were assembled properly. After the leak check, the section was sent to the test lab to be 
placed in a temperature controlled oven. The hot soak test section was set up so that no fittings 
were in direct contact with the oven walls. The tube section was elevated to ensure the fittings 
were also placed roughly in the middle of the oven. Figure 4 shows the test section in the oven 
and Figure 5 is a rough sketch of the test facility. 



Figure 4 - Test Section in Ch en Prior to Beginning Hot Soak Test 
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Figure 5 - Sketch of the Test Facility Used for the Hot Soak Test 


Hydrazine was then introduced and the line pressure was regulated to 320 ± 10 psig and die oven 
temperature was controlled to 225 +0/-10 °F. The temperature and line pressure w ere monitored 
with a strip chart recording the line pressure, and the temperatures of fittings 1 and 2, and the 
oven. Periodically, the hydrazine within the test section was locked into place by shutting the 
valve from die supply hydrazine to ensure there were no leaks within the test section throughout 
the test period of 3.5 days. This test of line pressure was performed twice daily. 

The hydrazine used in this test w r as collected before and after the soak for an analysis to 
determine the level of metal introduced from the fittings. A comparison of diese analyses can be 
found in section 4.0. 

3.1.1 Torque Schedule 

All fittings in the test section were assembled with 177 in-lbs. of torque. Each fitting also 
followed the same torque schedule as the CALIPSO program with several re-torques. Table 1 
outlines the torque schedule used for each fitting. 
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Table 1 - Torque Schedule Used for the Assembly of the Hot Soak Test Configuration 


Fitting Number 
(Refer to Figure 3) 

Number of 
Re-torques 

Time Delay for Re-tightening 

1 

3 

1) 1 min after first tightening 

2) 2 min after first tightening 

3) 24 In's, after first tightening 1 

2 

2 

1) 1 min after first tightening 

2) 12 hrs. after first tightening 

3 

2 

1) 1 min after first tightening 

2) 12 hrs. after fust tightening 

4 

2 

1) 1 min after first tightening 

2) 12 hrs. after first tightening 


3.2 Nickel Seal Soak Tests 

The nickel seal soak tests were developed to measure die compatibility of the seals and hydrazine 
without any other components present. The (previously described) hot soak test was performed 
with several metals that contain nickel. Any results of nickel interaction could be from the CRES 
304 fittings, or the system used for testing. The nickel soak tests only contained hydrazine and 
the nickel seals. Any metals found in the hydrazine after any length of time would come directly 
from the seals themselves. The nickel seal soak tests were divided into two groups. The first 
group began in parallel with the hot soak test with unused seals. The second group of soak tests 
began after the hot soak test was completed using the seals removed from die flight configuration. 
These seals had different surface characteristics due to their use in a fitting. 

3.2.1 New Seals 

To ensure die amount of nickel seal exposure in die hydrazine was similar to the propulsion 
system, the nickel seal surface area in contact with hydrazine for any fitting was assumed. The 
nickel surface area to hydrazine volume ratio was dien calculated for the length of one fitting. 
(Volume based on a 0.218” diameter and a 1.25” length). This ratio was dten used to determine 
the amount of hydrazine required to achieve this same ratio for exposure of an entire nickel seal. 
The result was 10 mL of hydrazine for every nickel seal used in a soak test. 

With the calculated ratio of hydrazine and nickel surface area determined, the test was set up to 
provide a variety of results. The test was divided up into two separate environments. There were 
several samples left at room temperature for 75 days, and one sample monitored at 120°F for 10 
days. The room temperature test included three hydrazine samples of 50 mL. and one hydrazine 
sample of 100 mL. One 50 mL sample was a control, which contained no nickel seals and acted 
as a baseline for comparison of nickel levels. A second 50 mL sample contained five nickel 
seals, and the last 50 mL sample contained one nickel seal. The one nickel seal sample was used 
to determine if the amount of nickel interaction could be scaled down linearly for different area to 
volume ratios when compared to the 5 seal sample. The 100 mL sample contained 5 nickel seals 
set up for weekly analysis over a 36-day period. The analysis technique used requires 10 mL of 
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hydrazine per run, which would leave this sample with 50 mL remaining at the end of 36 -days, 
leaving all samples with the same volume of hydrazine. The last sample at 120°F contained 50 
mL of hydrazine with five nickel seals. The results of this test were compared to the 36day 
exposure sample to validate the use of an accelerated test. Table 2 shows a breakdown of the new 
seal soak tests performed, and Figures 6 and 7 show the hydrazine samples in their respective test 
configurations. 


Table 2 - New Seal Soak Test Breakdown 


Sample Description 

Volume of 
Hydrazine 

Seals 

QTY 

Test Duration 

Temperature 

Scheduled 
Analysis [days] 

Control 

50 mL 

0 

75 -days 

Ambient 

0, 36, 75 

Fitting Exposure 

50 mL 

5 

75 -days 

Ambient 

36, 75 

Fitting Exposure at 
Elevated Temperature 

50 mL 

5 

10-days 

120°F 

10 

One Seal Exposure 

50 mL 

1 

75 -days 

Ambient 

36, 75 

Fitting Exposure with 
Weekly Check 

100 mL 

5 

75 -days 

Ambient 

7, 14, 21, 28, 
36, 75 



Figure 6 - New Seal Soak Ambient Test Setup 
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Figure 7 12CPF Accelerated New Seal Soak Test Setup 
3.2.2 Used Seals 

The seals used in the soak test outlined in 3.2.1 were placed in hydrazine as delivered from the 
manufacturer. To compare the effects of surface characteristics, the seals used in the hot soak test 
were removed from the flight-like configuration and placed in hydrazine for an extended soak 
time of 36 days. Table 3 outlines the test setup for the used seals removed from the hot soak test 
configuration. The seals were labeled according to their fitting designation outlined in Figure 3. 
Fittings 3 and 4 have upstream and downstream designations due to the use of a union used in 
place of a thruster. (Upstream refers to the union location where the thruster is attached in the 
flight configuration.) 


Table 3 - Used Seal Soak Test Breakdown 


Sample Description 

Volume of 
Hydrazine 

Seals 

QTY 

Test 

Duradon 

Temperature 

Scheduled Analysis 
[days] | 

Control 

30 mL 

0 

38-days 

Ambient 

0, 38 ! 

Fitting #1 

30 mL 

1 

38-days 

Ambient 

14, 21, 38 

Fitting #2 

30 mL 

1 

38-days 

Ambient 

14, 21, 38 

Fitting #3 (Upstream) 

30 mL 

1 

38-days 

Ambient 

14, 21, 38 

Fitting #3 
(Downstream) 

30 mL 

1 

38-days 

Ambient 

14, 21, 38 

Fitting #4 (Upstream) 

30 mL 

1 

38-days 

Ambient 

14, 21, 38 

Fitting #4 
(Downstream) 

30 mL 

1 

38-days 

Ambient 

14, 21, 38 j 
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3.3 Materials Used 

Table f4 outlines the materials used in the construction of the test setup used in the hot soak test, 
and the nickel seal soak tests. 


Table 4- Fitting and Tubing Material Used for the Hot Soak and Nickel Soak Tests 


Part # 

Description 

AN 8 15-4,1 

0.25” OD CRES 304 Flared Union 

AN815-4T 

0.25” OD Titanium Flared Union 

ANSI 8-4 J 

0.25” OD CRES 304 “B-Nut” 

AS5176-J-04 

0.25” OD CRES 304 Flared Sleeve 

A54824N04 

0.25” OD Nickel Conical Seal 

Ti 3AL-2.5V 

0.254/0.25” OD x 0.0172/0.0148” 
Wall Titanium tubing 


Along with the materials listed above, a Krytox Grade 240 AC lubricant was applied to each 
fitting before assembly. The same lubricant is used in the assembly of the fittings for the 
CALIPSO spacecraft. 

3.3.1 Nickel Seals 

Table 4 shows the part number of the nickel seals used throughout these tests. The information 
shown in table 5 outlines the elements that make up the seals and the percentage of each present 
in one seal. This information was provided by the supplier at the time of delivery. 

Tabic 5- Elemental Breakdown of the Nickel Seals 


Element 

% 

Carbon (C) 

0.015 

Manganese (Mn) 

0.245 

Sulfur (S) 

0.0005 

Silicon (Si) 

0.007 

Nickel (Ni) 

99.39 

Copper (Cu) 

0.004 

Cobalt (Co) 

0.005 

Iron (Fe) 

0.14 
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Visually, the seals have a shiny appearance with well defined edges. Figure 8 shows images of a 
seal taken under a microscope prior to installation in the hot soak test configuration. AH seals 
used in these tests had a similar appearance. 



Figure 8 - Magnified Images of the Nickel Seals, (a) Image looking down into cone of seal. 
[37x] (b) Close-up of rim edge. [202x] (c) Close-up of seal wall. [lOOx] 
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4.0 RESULTS & DISCUSSION 

4.1 Hot Soak Test 

The hot soak test began on Wednesday, January 14, 2004 at 8:30am and continued until Sunday, 
January 18, 2004 at 9:10 am. The test duration was 4 days and 40 minutes, surpassing the 
expected test duration of 3.5 days. The average fitting temperature throughout the time period 
was 222°F, with an average line pressure monitored to 320 psig. 

4 . 1. 1 Hydrazine Assay Comparison 

Table six shows the comparison of nickel levels in the hydrazine samples taken before and after 
the soak test An Inductively Coupled Plasma (ICP) teclmique was used to measure trace metals 
in the hydrazine samples. The ICP machine can be used to trace metals in a solution with an 
accuracy of around + 20 parts-per-billion (ppb). The values listed below were obtained with a 10 
mL volume of sample placed in the measuring device. 


Table 6- Nickel Levels in Hydrazine Before and After Hot Soak 


Hydrazine Sample 

Nickel Levels [ppb] 

Pre-Hot Soak 

48 

Post-Hot Soak 

37 


The results are presented in parts-per-billion (ppb) by weight, which can be interpreted as 48 
grams of nickel per every billion grams of hydrazine. Levels of nickel are present in the 
hydrazine, however, did not increase when exposed to the fittings for the 3.5-days. This shows 
the nickel seals have little interaction with the hydrazine. 

4. 1. 2 Visual Observation 

The nickel seals all had surface-scratch markings from the location where the flared tube and 
male threads sandwiched the seal together. Some seals had traces of residual lubricant, however 
no seal appeared to have pitting or evidence of corrosion. Figure 9 shows a comparison of a pre- 
soak seal and two seals after soak testing. 
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Figure 9 - Comparison of nickel seal appearance before and after hot soak test: (a) Sample 
seal before test, (b) fitting 1 seal after soak test, (c) fitting 3 seal after soak test 

[All images x 37] 


4. 1.3 Torque Requirements 

At the completion of the hot soak and before disassembly, the original torque strength applied to 
each fitting was checked The original torque strength of each fitting per the torque schedule 
outlined in Table 1 was 177 in-lbs. All but one fitting B-Nut failed this test. Table 7 below 
outlines the torque strength of the fittings after the hot soak test, where upstream and downstream 
refer to the respective sides of the union used in place of the thrusters. Upstream is the B-Nut that 
simulates the thruster connection in the propulsion system. 


Table 7- Fitting Torque Strength Post-Hot Soak Test 


fitting# 

Torque Strength 
[in-lbs] 

1 

145 

2 

145 

3 (Upstream) 

>177 

3 (Downstream) 

160 

4 (Upstream) 

150 

4 (Downstream) 

175 


Results show that the torque strength decreased for all but one fitting during the hot soak test. 
Evidence of whether or not this was an artifact of the hydrazine exposure, the elevated 
temperature, or a combination of both is not clear. The re-torque schedule shown in section 3.1.1 
was followed and all fittings began the test with 177 in-lbs of torque. (The torque schedule was 
compromised for fitting 1. Section 4. 1.4. 2 explains why this fitting did not follow the torque 
schedule. However, it does not appear to be the cause of the decreased torque strength.) Even 
with a maximum difference in torque strength of 32 in-lbs, no fitting leaked throughout, and after, 
the hot soak test. 
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4.1.4 T est Operation 

4.1. 4.1 Oven Performance 

The oven used in the hot soak test performed well throughout the test period with a few instances 
of instability. The initial occurrence with the oven happened the first night the oven was left 
unattended. Shortly after personnel had completed a leak check of the test section, the oven door 
became slightly un-latched and allowed the temperature inside of the oven to drop. A 
thermocouple was placed near the bottom of the oven to monitor the environment temperature, 
and its reading dropped from 222°F to an average of about 215°F for a 13 hour period until the 
work shift began the next day. The reading on the strip chart showed that in this time, the oven 
control system tried to regulate temperatures with a large fluctuation of this thermocouple 
reading. However, the fitting temperatures dropped only 2F, staying within f¥ of the 225°F 
target. It was determined that the test section temperatures did not drop significantly enough to 
re-start the test and that the test would be extended for 13 hours to compensate for this 
occurrence. The oven door was secured with wire and the door remained closed for the 
completion of the test. 

A second complication with the oven was a delayed relay in the oven control scheme. At times, 
the oven temperature would instantly begin to rise from 222°F to around 230°F, then the 
controller would regulate temperatures. This happened approximately 6 times throughout the test 
period with no repeatability. Tn the late morning hours of the second day of the test, the oven 
reached its over temperature limit of 235°F and shut all power to the oven. A test technician 
heard the oven alarm and reset the oven after 10 minutes of shut down. The fitting temperatures 
remained at 222°F during this down time and the test resumed. The line pressure was stabilized 
and it was determined that this shut down would not affect the results of the test. This was the 
only time that the oven shut down by itself. 

4. 1.4. 2 Fitting Integrity 

As mentioned in section 3.1, the assembled test section followed a torque schedule similar to the 
procedures of the CALIPSO program. After all re-torques were completed, the section was put 
through a proof pressure and helium leak check to ensure fidelity of the test configuration. 
During the pre-hot soak proof pressure test using snoop on each fitting, it was discovered that 
there was a leak in fitting #1. This fitting was subjected to 3 re-torques at 177 in-lbs. and failed 
the proof pressure test at 480 psig (1.5 x MEOP). The fitting was disassembled and examined. It 
was discovered that there was a small notch in the rim of the titanium threads that did not allow 
the fitting to form a leak tight seal. The fitting was polished using fine sandpaper (level 600) and 
re-assembled with a new nickel seal. The threads were also cleaned and Krytox 240 AC was 
applied once again. Since the torque schedule defined the last re-torque to take place 24 hours 
after the original tightening, it was determined to only perform 2 re-torques due to time 
constraints in the test lab. After the second re-torque the system was put through a second proof 
pressure check. The fitting did not leak during this second leak check die test began prior to 
performing the last re-torque of fitting 1 . 

4.1 .4.3 Line Pressure 

Throughout the test, the line pressure of the test section was controlled by a pressure regulator. 
To ensure that there were no leaks throughout the test section, the valve from die pressure 
regulator was shut oft' and the trapped pressure was monitored. It was observed that the line 
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pressure was highly sensitive to the temperature of the lab. Part of the test section was secured 
outside of the oven, and as room temperatures decreased, so did the recorded line pressure. This 
was confirmed with a technician covering the test section outside of the oven with insulation. As 
soon as the tube was covered, there was an instant increase in line pressure. This pressure 
fluctuation was observed throughout the test period. At no time did pressure drop due to a leak in 
the system. 

4.2 Nickel Soak Tests 

The test plan outlined in section 3.2 shows two sets of soak tests with a range of assays to be 
completed throughout the test period. The motivation behind this plan was to track changes in 
nickel levels over the test duration. However, the reported data is limited due to an anomaly with 
the analysis equipment used for the hydrazine assays. 

4. 2. 1 Assay Equipment Anomaly 

The hydrazine assays were analyzed using a Perkin Elmer Optima 3000 Axial ICP-OES 
instrument used for tracking metals in solutions. Hydrazine assays were to be performed on a 
weekly basis throughout the duration of both soak tests beginning on January 9. When the third 
week sample of the new seal test was analyzed (Week of January 26), the results showed 
inconsistencies and errors when compared to previous samples. This resulted in a detailed 
investigation of the ICP instrument with two maintenance visits and a completed repair on March 
9. Therefore, the results presented in the next two sections are limited to assays preformed prior 
to January 26, and after March 9. 

4.2.2 New Seals 

The new seals were placed in hydrazine on January 9 and completed testing on March 22. 
Hydrazine samples w ere analyzed for the first two weekly assays, and at the end of the 75-day 
test duration. Tables 8 shows the nickel levels measured with the ICP instrument. Data is shown 
as the raw nickel level in parts per billion (ppb), the change in nickel levels between the control 
and the sample of interest (A), and the change in nickel per seal in the sample (A / seal). Figure 10 
represents this data as a function of time. 
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Table 8- Nickel Levels in New Seal Samples after the Specified Days of Exposure and 

Tem perature 


Sample Description 

Seals 

QTY 

Day from 
Start of 
Soak [days] 

Temp. 

Nickel 

Levels 

Ippb] 

A 

[ppbl 

A / seal 
[ppbl 

Control 

0 

75 

Ambient 

31 

0 

- 

Fitting Exposure 

5 

75 

Ambient 

221 

190 

38 

Fitting Exposure at 
Elevated Temperature 

5 

10 

120PF 

86 

55 

11 

One Seal Exposure 

1 

75 

Ambient 

72 

41 

41 

Fitting Exposure with 
Weekly Check 

5 

7 

Ambient 

50 

19 

3.8 

13 

Ambient 

91 

60 

12 

75 

Ambient 

181 

150 

30 



05 seals; Weekly Sampling a 5 seals; 120F for 10-days 

A1 Seal; No Intermediate Sampling X5 seals; No Intermediate Sampling 

Figure 10 -Change in Nickel Levels per Seal Present in Hydrazine Sample 


The data presented graphically shows the general trend of nickel levels over an extended amount 
of time. The trend line shown is based on the weekly sampling data and is a rough estimate due 
to the lack of data in the middle of the soak test. However, the trend is expected with this type of 
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compatibility test. The rate of metal leeching is greatest at the beginning of exposure and then 
begins to level off w ith time. 

The results presented after 75 days of exposure are all within 1 1 ppb, show ing die same amount 
of nickel leeching per seal in the hydrazine. The linear relationship between one seal in sample, 
and 5 seals is confirmed with this data. All of this data is presented without taking into account 
the ratio of nickel seal surface area and the volume of hydrazine. However, the one seal sample, 
and the five seal sample with no intermediate sampling were exposed to the same volume of 
hydrazine and their change in nickel per seal was w ithin 3 ppb. 

The final data point of the sample tested at 120°F was plotted twice at 10 days, and at 36 days. 
The 36-day plot is shown since the elevated temperature test w as supposed to simulate 36 days of 
exposure after 10 days. The data clearly falls in family of the weekly exposure data at room 
temperature after 10 days, and out of family for 36 days. The accelerated test did not appear to 
simulate the 36 days of exposure. 

4.2.3 Used Seals 

Once the hot soak test was completed, the seals were removed, cleaned of lubricant, and placed in 
hydrazine. Each individual seal was placed in tire same amount of hydrazine in separate 
containers on February 2 for 38 days at ambient conditions. Table 9 and Figure 11 show the 
amount of nickel found in the hydrazine samples. (All references to fitting numbers can be found 
in Figure 3.) 


Table 9- Nickel Levels in Used Seal Samples after 38 - Days of Exposure at Ambient 

Conditions 


Sample Description 

Seals 

QTY 

Day from 
Start of 
Soak [days] 

Temp. 

Nickel 

Levels 

Ippb] 

A 

[ppb| 

Control 

0 

38 

Ambient 

45 

0 

Fitting #1 

1 

38 

Ambient 

88 

43 

Fitting #2 

1 

38 

Ambient 

63 

18 

Fitting #3 (Upstream) 

1 

38 

Ambient 

95 

50 

Fitting #3 
(Downstream) 

1 

38 

Ambient 

160 

115 

Fitting #4 (Upstream) 

1 

38 

Ambient 

90 

45 

Fitting #4 
(Downstream) 

1 

38 

Ambient 

199 

154 
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Figure 11 — Change in Nickel Levels per Used Seal 

The data presented shows a wide spread of nickel levels for used seals. A maximum change was 
measured to be 154 ppb, while the minimum change was only 18 ppb. This spread shows the 
sensitivity of nickel leeching to the surface properties of the seals. All samples were tested in the 
same volume of hydrazine under the same temperature conditions, and were torqued to the same 
value for the hot soak of 3.5-days at 225°F. 

4. 2 . 4 Comparison of New and Used Seal Data 

The major difference from the two sets of soak tests was the surface condition of the used seals. 
The spread of nickel leeching for the used seals after 38 days was 136 ppb, while the new seals 
had a spread of 1 1 ppb after 75 days. This data was observed with a varying amount of hydrazine 
at the time a sample was removed for analysis. A seal that has a change in its surface properties 
will react differently in the hydrazine than a new seal. 

4.3 General Observations 

The data collected shows that the nickel from these seals does leech into the hydrazine, but in 
small amounts. Of all the testing completed, the largest nickel level recorded in any hydrazine 
sample was 221 ppb. As a comparison to hydrazine purity standards, the levels of iron acceptably 
for hydrazine used on a spacecraft is between 2 and 4 ppm. The measured value of 0.2 ppm will 
not affect the hydrazine any more than leeching of other metals from the propulsion system tank 
and fuel lines. 
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The most realistic test performed in this investigation was the hot soak test with a propulsion 
system mock-up exposed to hydrazine at elevated temperatures. The amount of nickel exposed to 
the hydrazine is representative of the flight system, whereas the soak tests had a much higher 
nickel seal surface area to hydrazine volume ratio. The results of this test showed no noticeable 
increase in nickel levels after exposure was completed as shown in Table 6. In fact, with the 
CRES fittings and titanium tubing, the change in iron found in the post-hot soak hydrazine 
sample was on the order of 1000 ppb. Clearly, leeching of metals is occurring in the propulsion 
system at normal rates. However, the seals do not add a concern of nickel levels in hydrazine. 
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5.0 CONCLUSIONS 

The hot soak test and the series of nickel seal soak tests with both used and new seals show ed the 
effects of nickel leeching into hydrazine. The results showed that the nickel leeching into the 
hydrazine occurred in small amounts relative the other metals found in the propulsion system. 
The seals did not appear to corrode in the hydrazine after various lengths of time and different 
volumes of hydrazine exposure. Based on the compatibility ranking used in AFRPL-TR-69-149, 
the nickel seals used in this propulsion system can by classified as a class “A” application. The 
seals do not appear to compromise the integrity of the fittings used in this propulsion system. 
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Notes from Alcatel Site Visit May 12 & 13, 2004 

Rick Gilbrech (06-04-04) 


The purpose of this site visit was to gather information from Alcatel and CNES concerning 
NESC and IPMC actions regarding the CALIPSO Proteus propulsion bus. The meeting included 
attendees from Alcatel, CNES, NASA GSFC, NASA GRC, and the NESC. The meeting began 
with an overview of response information by Alcatel and a tour of the 100,000 class spacecraft 
assembly/welding/x-ray/cleaning room used to assemble the CALIPSO Proteus bus. The facility 
was clean, well organized, and comparable to clean room assembly facilities in America. The 
team that performs all of Alcatel propulsion assembly consists of three operating technicians 
each with at least three years experience assembling Alcatel propulsion systems and a quality 
control inspector with 7 years experience at Alcatel. This team assembles 100 A/N fittings per 
year and can be traced by name to the specific inspections, lubrications and assembly of the 5 
CALIPSO Proteus A/N fittings. The leak detection lead that performs the testing at Alcatel also 
travels to VAFB with the same equipment to perform the fill and drain valve and thruster valve 
leak tests. An attendance list and summary of actions was completed at the close of the two-day 
meeting (ref. Minutes of Meeting CNES document # CAL-P0-CR-682-CNES, filename “MOM- 
safety NESC & IPMC Propu- Audit 13-5-04.doc”). 

NESC-R-001 


Project shall demonstrate that Alcatel training and/or assembly documentation provided for 
proper lubrication of fluid fittings during assembly. Assembly procedures shall clearly 
delineate the type, quantity, and location where lubricant was applied and ensure sealing 
surfaces are kept dry and free of any contaminant. 

Site Visit Notes: 

Torque Wrench: During the tour of the assembly clean room it was noted that the torque wrench 
used to tighten the B-nuts for CALIPSO is calibrated annually. The 5 CALIPSO A/N assembly 
procedures were performed in Dec 03 and the calibration occurred two months earlier in Oct 03. 
The wrench has a ±1.0 N-m tolerance. 

Hydrazine tank fitting: The hydrazine tank comes certified clean from Raphael with the outlet 
tube and male end of the tank A/N fitting attached. The tank is bolted to a non-flight assembly 
plate and the plate is mounted to a rotating assembly cart. The jig on the assembly cart has a 
locking rotational wheel that allows 360° plate rotation about the Y-axis (i.e., flip the tank upside 
down) for easy access to the top and bottom of the tank during assembly. With the tank upside 
down (bottom facing upward) the fitting is oriented horizontally where a handheld magnifier was 
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used to perform a 4X visual inspection of this sealing surface. No flaws were noted in any of the 
visual inspections, but if they were, the part would be examined under 40X magnification. This 
and all fitting surface inspections are done by the quality control (QC) inspector’s eyes only. 

The female fitting with a short (6 inch) pre-formed %” diameter tube (certified clean) is supplied 
by Raphael and received a similar successful 4X visual inspection under a binocular microscope. 
Note that this female tube end is flared on a flaring machine at Raphael whereas the four thruster 
female fittings use machined tube ends fabricated at Alcatel. The nickel conical seal was given 
a 4X visual (both sides) with a binocular microscope. 

The fittings were then lubricated with 6 drops of Opanol lubricant applied as follows: 2 drops 
180 degrees apart on the middle portion of the male threads. The tech then changes to a new set 
of gloves and applies 2 drops to the backside of the 37° flare tube end that contacts the sleeve, 
changes gloves once more and applies 2 drops to the outside of the sleeve that contacts the 
female nut. The lube procedure is witnessed and stamped by QC. 

The torque sequence was then performed with each torque step recorded and stamped by QC. 
The actual CALIPSO torqueing procedure was presented showing that the torque wrench ID and 
valid calibration dates were recorded. Note the fitting is horizontal for assembly and accessed 
through cutouts in the bottom of the non-flight assembly plate. Neither break away nor running 
torque on subsequent torques was recorded, just a verification that 20 N-m was achieved. The 
final step was installing the lock wire which was also witnessed and stamped by the QC 
inspector. All of these procedures were successfully completed for the CALIPSO Proteus tank 
fitting with no anomalies noted. 

Thruster Fittings: The tubes with machined flare ends are fabricated and cleaned at Alcatel. A 
4X visual inspection was performed but unlike the tank fitting, they follow a slightly different 
assembly process. Once inspected, they are lubricated and temporary caps are installed to 
protect the sealing surfaces. The upper and lower tube assemblies are pre-positioned and welded 
as described below. Both assemblies are installed on the -X propulsion panel where the final 
weld is performed joining upper and lower assemblies. The protective caps are removed, the 
female fittings are cleaned and then given another 4X visual inspection. The thruster male 
fittings and both sides of the nickel seals are given a 4X visual inspection and then the fittings 
are lubricated as described for the tank fitting. The fittings are then assembled, torqued and lock 
wired with similar witness/stamp by QC. 

Tubing Assembly Sequence: The N2 and N2H4 fill and drain valves along with their weld- 
prepped tube lines are pre-positioned on the upper (+X) side of the non-flight assembly plate. 
The N2H4 fill and drain valve line mates to the assembled tank fitting/pre-formed !4” diameter 
tube stub described above. The lower line assemblies are pre-positioned next and then upper 
and lower tube assemblies are welded in a maintain-clean weld process (orbital arc welder using 
parent material with inert gas purge). These are then detached from the non- flight assembly 
plate (still as two separate assemblies) and installed on the -X propulsion panel. The final weld 
attaching the upper fill/drain line to the lower thruster feed manifold is performed. With the -X 
propulsion panel in flight orientation the thruster female fittings are pointing towards the ground. 
The technician indicated the nickel seal is placed on the male fitting integral to the thruster and 
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the thruster is brought vertically up to mate with its corresponding female half. This is 
considered the ideal orientation to assemble an A/N fitting with the least likelihood of the seal 
shifting as the two halves are brought together. 


NESC-R-002 


Project shall demonstrate Alcatel training and/or assembly documentation provided for a 
visual inspection of fluid fittings prior to assembly. Assembly procedures shall ensure 
components had no visible defects and sealing surfaces were clean and dry. 

Site Visit Notes: 

Technician training referenced a torque training manual (#15) and on the job peer training. All 
other issues were addressed above in NESC-R-001 notes. 

NESC R-003 


Project shall demonstrate that the PROTEUS mechanical fittings are rigorously tested using 
techniques adequate to validate system integrity. Leak check procedures shall specify test 
method, equipment to be used, media, test pressure, and allowable leak rate. 

Site Visit Notes: 

Acceptance Tests at Alcatel 

Proof Test/Fitting Sniff Test: Once the tubing assembly is completed, the acceptance testing 
begins. The first step is a pressure proof test with GHe to 33 bar gage for 5 minutes. The 
pressurization rate and the temperature rate are both controlled (temperature not to exceed 35°C 
and pressurization rate not to exceed 0.5 bar/min). The pressure is lowered to 22 bar and the 5 
A/N fittings are sniffed with a mass spectrometer with pass criteria of leakage <10' 6 standard 
cubic centimeters per second (scc/sec) of GHe. This portable mass spectrometer has a sensitivity 
of 10' 9 scc/sec level. According to the leak detect lead, Jean Rodriguez, the mass spectrometer is 
calibrated before any leak test with a calibrated GHe leak (during the tour, the calibration bottle 
shown indicated 10' scc/sec). Each of the five fittings registered in the 10' scc/sec range in the 
as run CALIPSO procedure. 

Overall leak test: The next test is the overall leak test to quantify leakage from the 5 A/N 
fittings. The entire -X propulsion panel with tank, tubing, valves and thrusters is installed in a 
transport container. The system is pressurized to 22 bar with GHe and the fill and drain valves 
are torqued close to less than flight torque and capped. The fill and drain valve seats are 
designed to permanently deform when torqued to flight torque to ensure maximum sealing. 
Therefore the only time these valves are torqued to flight level is when the tank is filled and 
pressurized and the valves will not be opened again. To prevent leakage through the thrusters 
from contributing to the overall leak rate, special sealing fixtures are attached to each of the four 
thruster nozzles to extract any leakage through the thruster seats. The sealing fixtures have tubes 
running to a separate vacuum pump to isolate their leakage. A blower is installed and switched 
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on inside the container to circulate flow. The container is then flushed with GN2 for one hour 
and sealed at ambient pressure. The mass spectrometer is calibrated and leakage is measured for 
12 hours. Data acquisition is stopped and the mass spectrometer is recalibrated. A calibrated 
GHe leak (6.5 x 10' 5 scc/sec) is then introduced into the container for the next 12 hours and 
recorded. Data acquisition is again stopped and the mass spectrometer is calibrated. Data is 
again recorded for 5 minutes to confirm no drift or anomaly with the mass spectrometer then the 
test is concluded. A formula is then used comparing the leak rate slopes before and after the 
introduction of the calibrated leak to derive the overall leak rate. The derived overall leak rate 
for CALIPSO was 2.39 x 10~ 6 scc/sec. The success criterion is 8.4 x 10" 5 scc/sec. 

Thruster leak tests: The system is pressurized to 22 bar with GHe and the thruster sealing 
fixture is attached to a thruster and connected to the mass spectrometer. Leakage is then 
measured and the procedure repeated for the other three thrusters. All passed the success criteria 
of leakage < 10' 5 scc/sec. 

Fill and drain valve leak test: With the system pressurized to 22 bar with GHe, the GN2 fill and 
drain valve is connected to the mass spectrometer via its A/N connector and leakage recorded. 
This is repeated for the N2H4 fill and drain valve. Both passed the success criteria of leakage < 
2.8x10-4 scc/sec. 

After these leak tests the system is pressurized to 13 bar and a gas sample is drawn through the 
fill and drain valves to verify cleanliness and moisture requirements are met. 

Post Environmental Test Leak Checks at Alcatel 


The Proteus bus is then integrated with the instrument and put through thermal and vibration 
testing with the system pressurized at 3 bar. After this the following leak tests are repeated: 

Overall leak test: The entire spacecraft is put in a transport container and the above procedure is 
repeated. 

Thruster leak tests: The above procedure is repeated although this time the test/arm plug is used 
to check the individual valve seats (downstream first, then upstream) to the same leak criteria. 
Once these tests are completed the test/arm plugs remains installed for the remainder of the 
launch campaign. 

Fill and drain valve leak tests : The leak test is repeated as described above. 

After these leak tests the hydrazine pressure transducer is calibrated at 22 bar and then a mass 
flow test is performed on each individual thruster with the system at 2.5 bar to 7.5 scc/sec. This 
test verifies that the software and wiring are controlling correctly. Although all four thrusters are 
normally fired simultaneously, this verification is needed in case of a thruster failure where the 
software can deselect the thruster opposite the failed thruster and the remaining two can still be 
used without loss of mission (one fault tolerance). 
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Leak testing at VAFB 


After transport and receipt at YAFC, the system is pressurized to 22 bar with GHe and a 12 hour 
pressure decay test is performed by monitoring the onboard temperature and pressure via 
telemetry. A pressure polynomial equation accounting for temperature variation is used to 
determine the pressure. The temperature measurement range is -40 to 60 °C with 12 bits (1 sign 
+ 11 data) corresponding to 0 YDC low (-40 °C) and 5.1 VDC high (60 °C) yielding a 
temperature resolution of 0.0488 °C. Similarly, the pressure measurement range is 0 to 22 bar 
with 1 1 bit resolution or 0.0107 bar. Adding in the 0.2% FS error of the pressure transducer 
(0.044 bar), the quoted resolution of the end to end pressure measurement is 0.054 bar. The 
success criterion of the 12 hour leak test is that the pressure drops no more than the resolution of 
the measurement system (e.g., 22.0 - 0.054 = 21.946 bar final pressure). With the system still at 
22 bar, the thruster and fill and drain valve leak tests are performed as described above. As 
mentioned, the test/arm plugs are installed so this thruster leak test measures leakage across both 
seats. 

NESC-R-004 


Project shall demonstrate thermal and vibration loads applied to the spacecraft during 
environmental tests envelope conditions it will experience from servicing through launch. 

Site Visit Notes: 

Environmental test conditions 

The vibration level inputs at the shaker table are on the order of 1.5 to 2 g’s resulting in predicted 
first mode levels at the center of the -X propulsion panel of 9 g’s and 20 g’s at the thrusters. The 
thermal environments during test at Alcatel and at VAFB are summarized in the following table. 



Alcatel Average Test 
Temp °C 

Alcatel Thermal Cycling 
Temp °C 

VAFB Temp °C 
(PPF/White Room) 

Max 

30 

45 

25/20.6 

Min 

15 

0 

19/15 


Temperature during spacecraft transport from the Payload Processing Facility to the pad is not 
quoted, but the handling can is double bagged and purged with dry gaseous nitrogen during this 
period. 

Qualification tested hardware 

Alcatel does not have access to the EUREKA A/N fitting qualification data as was implied. 
Qualification for Proteus was performed through a propulsion qualification model put through a 
mechanical and thermal environment that enveloped the Delta II interface control document 
levels. Alcatel stated the vibration levels were 1 .5 x Delta II grms levels and a final performance 
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test was conducted. Alcatel has an action to provide the report detailing these test levels. 

Alcatel also referenced qualification data from Raphael that was performed for an Israeli satellite 
and another program from EADS on the GLOBALSTAR program. Bryant Cramer has the 
action to provide these two test reports. 

NESC-R-005 


Project shall demonstrate that servicing procedures adequately control temperature, pressure, 
and flow rates to minimize the potential for leakage. 

Site Visit Notes: 

Alcatel provided the procedure used to fill and pressurize JASON- 1 that will be used for 
CALIPSO. This procedure detailed adequate control of temperature and pressurization rates 
during filling and pressurization to preclude significant internal pressure or thermal transients. 
Hydrazine fill flow rate is limited to < 8.3 crnVsec for the first 5 liters and then kept at < 33 
cm /sec for the remaining fuel load (28 kg total for JASON-1). Nitrogen pressurization is 
constrained to T max < 35 °C and AP/At < 0.5 bar/min. Pressurization to 10 bar is incrementally 
achieved over 20 minutes with a 3 minute hold at 5 bar. From 10 to 15 bar the constraint applied 
is T max < 35 °C and AP/At < 0.2 bar/min. Once at 15 bar, there is a planned 30 minute hold then 
the final target pressure of 19.22 bar is achieved following a pressure/temperature table in the 
procedure. 

NESC-R-006 


Project shall verify that the controls at the processing facility and launch pad identified in the 
Final Report are in place to monitor for leakage from the time hydrazine is loaded until final 
closeout for launch. Additionally, the Project shall verify that spacecraft operations are 
minimized after hydrazine loading and that provisions are made for area securing and the 
rapid evacuation of personnel should a leak develop. Further, the Project shall coordinate 
with other payload/Delta II processing personnel to ensure the Projecfs approach for 
minimizing personnel exposure to potential hazards is properly integrated. 

Site Visit Notes: 

Jose Caraballo presented the capabilities of the VAFB payload processing facility and SLC-2 
white room detection/alarm systems that will be in place. Once the PPF site selection is made, 
these controls will be reviewed and verified. Bryant Cramer took an action to scrub the 
spacecraft processing 36-day timeline to ensure the fueling operation cannot be pushed any 
closer to launch. Cramer will also coordinate with other payload/Delta II processing personnel 
to ensure the Project’s approach for minimizing personnel exposure to potential hazards is 
properly integrated. 
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NESC-R-007 


Project shall demonstrate pre-servicing thruster leak checks will be adequate to validate 
system integrity. Leak check procedures should test each valve independently and shall 
specify the test method, equipment to be used, media, test pressure, and allowable leak rate. 

Site Visit Notes: 

The thruster leak check details were covered above in NESC-R-003 notes. 

NESC-R-008 


Project shall verify that the PROTEUS Moog valves on CALIPSO do not have defective 
plunger assemblies. 

Site Visit Notes: 

Alcatel provided the thruster valve part and serial numbers. The CALIPSO Proteus thruster 
valves were supplied by Wright Components Co. (also known as EG&G Perkin Elmer) with part 
number 18207-14, serial numbers 029, 030, 033 and 034. The suspect valves with defective 
plunger assemblies were manufactured by MOOG after it purchased Wright Components in 2001 
and moved manufacturing from Phelps, NY, to East Aurora, NY. The CALIPSO thruster valve 
part number and serial numbers used by Alcatel are exempt from the MOOG defective plunger 
issue. 

NESC-R-009 


The Project shall demonstrate that test procedures verify relays 16 and 1 7 are open before 
power is applied to the spacecraft. Since the design incorporates latching relays, verification 
of the last stable state by data retrieval or written record is acceptable. 

Site Visit Notes: 

After the test/arm plugs are installed the final time at Alcatel before shipment to VAFB, the 
ability of the ground operator to close relays 16 and 17 is inhibited by removing the 
telecommand “close relays 16 and 17” from the electrical ground support equipment Main 
Control and Data Test (MCDT) database. Two MCDT’s perform health and safety telemetry 
monitoring, telecommand sending and control, and specific checkout equipment control and 
monitoring (ref. CALIPSO Missile System Pre-launch Safety Package, p. 134). The software 
routine that powers off the spacecraft has a step to telecommand open relays 16 and 17. The 
independent relay position feedback circuit is checked and if the open indication is not received, 
an error message is displayed on the operators screen. Alcatel agreed to add a warning screen 
instead of an error message on the operator’s monitor and also add a safety warning in the 
procedure in case of this error/waming message dealing with relays 16 and 17. The forbidden 
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command management procedure (removal and verification) will be reviewed at the Pre- 
Shipping Review before the spacecraft leaves Alcatel. 

NESC-R-010 


Steps for inserting and removing test/arm plugs shall be explicitly called out in the ground 
processing timeline. Final installation for flight shall occur as late as possible; until that time, 
plugs should only be installed as required for thruster valve testing. 

Site Visit Notes: 

Alcatel stated that the test/arm plugs will only be used to perform the individual thruster valve 
seat leak tests outline in NESC-R-003. There eight plugs, two for each thruster circuit allowing 
each thruster to be fired individually. Once these tests are completed the plugs will remain in the 
spacecraft from that point on. Alcatel’s rationale is based on reliability concerns that once the 
spacecraft is fueled, there is no way to verify the test/arm plug function without hot firing the 
thrusters. 

NESC-R-011 


The Project shall verify that all thruster firing circuit inhibits function as designed. 

Site Visit Notes: 

Alcatel indicated the individual thruster mass flow test is considered the verification of the 
thruster wiring/inhibit circuitry. The test is designed to ensure that the polarity within the 
attitude control system is correct and to ensure that no significant blockage exists. No other 
evidence of manufacturing quality inspections or electrical continuity/resistance/functional 
checkouts was provided. The planned individual thruster mass flow test only exercises four of 
the possible eight combinations of the three commands (relay 17, 16 and spacecraft software 
opto-driver commands). Considering each command as a binary switch will result in 8 possible 
combinations or binary states. At power up all three are off (state 000 in binary terms), then 
relay 17 is commanded on (say 100 in binary terms), next relay 16 is commanded on (state 110) 
and finally the spacecraft software opto-driver command is sent resulting in thruster firing (state 
111). This means states 001, 010, 01 1 and 101 are never exercised. 

Bob Kichak (originator of this requirement) agreed that the planned mass flow checkout is an 
approach comparable to NASA programs (i.e., to confirm functionality), but wanted to 
recommend that the additional four states be exercised during the test if this could be reasonably 
accommodated. This would guarantee the inhibits function as intended. 

IPMC Action 1 (assigned 1-22-04) 

NESC to examine the magnitude of a fire hazard associated with hydrazine leakage onto 
adjacent materials and recommend suitable mitigation activities. 
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Site Visit Notes: 


Alcatel provide a listing of materials in the vicinity of the A/N fittings. Jim Free will provide a 
photo with labels identifying where these materials are located. Alcatel will provide chemical 
composition and estimated mass of these materials. The project provided material information 
on the barrier diaphragm between CALIPSO and CloudSAT and KSC provided material 
compatibility test reports on the diaphragm “skrim” cloth. NESC to have WSTF evaluate the 
hydrazine compatibility of these materials. 

IPMC Action 2 (assigned 1-22-04) 


NESC to work with VAFB to assess the adequacy of range capabilities to handle hydrazine 
leak rates ranging from catastrophic to plausible. 

Site Visit Notes: 

Alcatel will investigate the option of placing one to two %” Teflon leak detect tubes through the 
Multi Layer Insulation (MLI) blanket into the cavity between the -X closeout panel and the -X 
propulsion panel where the thrusters’ fittings are located. These will stay installed until just 
before Dual Payload Attach Fitting (DPAF) installation in the PPF. There are 13 calendar days 
between fueling and DPAF mate on the current timeline. Once mated to the DPAF, the project 
will assume responsibility to install leak detection into the DPAF for the remainder of time in the 
PPF and at the SLC-2 white room. 

IPMC Action 3 (assigned 1-22-04) 


Project to explore adding an accelerometer package on the satellite to capture accidental 
impacts due to lifting, transport, or accidents that might promote a hydrazine leak once the 
spacecraft is fueled. 

Site Visit Notes: 

The project is to define the accelerometer package requirements (g threshold considered 
hazardous, accelerometer specs (# axes, range, electronic vs. visually read trip gage), etc.). 
Alcatel to assess the feasibility of NASA’s proposed plan. 

IPMC Action 4 (assigned 1-22-04) 

OSMA (Code Q) to consider the need for a waiver to either NPR 8715.3 or EWR-127. 

Site Visit Notes: Cramer to continue working waiver to NPR 8715.3 with Code Q. 
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IPMC Action 5 (assigned 1-22-04) 


Project to implement all NESC requirements by traveling to France with a small team of civil 
servants to examine Alcatel procedures in a proprietary sensitive environment. Team to 
include the Chair of the Safety Working Group and a NESC Representative. 

Site Visit Notes: Meeting accomplished. 

IPMC Action 6 (assigned 1-22-04) 

Project to identify a highly experienced KSC lead person to be solely and fully responsible for 
personnel safety throughout the Launch Campaign, consistent with the IPMC course of 
action. 

Site Visit Notes: 

Jose Caraballo proposed Tom Palo (KSC ELV Safety Officer) and Gary Hendricks (KSC 
CALIPSO/CloudSAT Mission Assurance Manager) as co-leads with NASA VAFB Resident 
Office personnel serving as backups. This role would be active from hydrazine fueling until 
launch and will be accomplished by transferring the “Ops Safety Control Authority” from the 
project (normally Jose Caraballo) to this person for the remainder of the launch campaign. It 
was not clear exactly how this role would be defined and enforced in the ground ops process as 
the Launch Site Support Plan that establishes the ground processing authorities and procedures 
will not be modified to reflect this change. Concern is that the level of authority and in-line 
involvement of this person may not be clear to everyone. For example, it was not clear whether 
this person be a required signature on procedure redlines or other deviations from normal 
planned procedure. Perhaps a letter from the Program office clearly delineating this would avoid 
confusion. 

IPMC Action 7 (assigned 1-22-04) 

NESC to provide a risk assessment (NASA 5x5 matrix) of the propulsion issue once all of the 
propulsion actions are completed. 

Site Visit Notes: 

NESC to review all available information gained at Alcatel site visit and then assign the before 
and after risk levels on a 5 x 5 matrix. 

IPMC Action 8 (AETD request of January 29, 2004) 

Verify that the mechanical design of the spacecraft, DPAF, GSE, and the way they are used 
during mating precludes unplanned contact between the two spacecraft, the various parts of 
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the DPAF, and/or the GSE required in the vicinity during the several mating operations. 
Fixturing should provide sufficient guidance (e.g. guide pins) during the mating to preclude 
inadvertent lateral motion of the pieces while mechanical stops should preclude inadvertent 
vertical motion until initial positioning and stabilization had been achieved. This verification 
should include not only the DPAF to CALIPSO but also any parts of CloudSat that come near 
CALIPSO during the mating process. Consider whether it would be advantageous from a 
safety perspective to mate CALIPSO to the upper DPAF cone before it is removed from the 
loading facility. 

Site Visit Notes: 

During inspection of the CALIPSO spacecraft it was observed that thruster nozzles will protrude 
about 2” below the -X closeout panel. Access to the underside of the spacecraft in its upright 
position on the handling fixture once fueled will be very limited (only from beneath with no side 
access). 

IPMC Action 9 (AETD request of January 29, 2004) 

For the time period prior to DPAF mate, conduct a fire safety analysis to show that all 
materials in CALIPSO, the DPAF, CloudSat, and required GSE are appropriate for use in the 
presence of leaking liquid hydrazine, that the worst-case fire scenario is manageable, and that 
personnel can be protected. In this scenario, it should be assumed that the entire contents of 
the propellant tank would be emptied within 1 hour. Se e Addendum 7 to this report. 

Site Visit Notes: 

See IPMC-1. 

IPMC Action 10 (AETD request of January 29, 2004) 

For the period prior to DPAF mate, verify that the hydrazine leak detection capabilities and 
contingency plans for use during this time frame are sufficient to keep personnel safe under 
the assumption that the entire contents of the propellant tank would be emptied within 1 hour. 

Site Visit Notes: 

Jose Caraballo presented PPF precautions prior to DPAF mate. These include toxic vapor leak 
detect systems and alarms as standard measures. Additional measures will include personnel 
dosimeter badges and a Zellweger Analytics CM4 continuous gas monitor with four point leak 
ports. See Caraballo briefing presented on 5-12-04 for additional details. 
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IPMC Action 11 (AETD request of January 29, 2004) 


For the time period after DPAF mate, conduct a fire safety analysis to show that all materials 
in CALIPSO, the DPAF, CloudSat, and required GSE are appropriate for use in the presence 
of leaking liquid hydrazine, that the worst-case fire scenario is manageable and that personnel 
can be protected. In this scenario, it should be assumed that the leak rate is at least 1 gram 
per hour and as much as 10 grams/hour and that liquid will be present. 

Site Visit Notes: 

See IPMC-1. 

IPMC Action 12 (AETD request of January 29, 2004) 

During the planned in-plant assessment of the propulsion system and bus pursuant to NESC 
Recommendations 1, 2, and 3, it should be verified that: 

a) The assembly procedures are sufficient to ensure that the desired pre-load can be 
consistently developed in the propulsion system threaded fittings; 

b) Every threaded fitting was inspected, assembled and independently verified to have 
been assembled per the procedure (e.g. QA witnessing of lubrication and torqueing of 
every fitting and individually noted). Recall that the EURECA qualification test article 
leaked due to a single improperly lubricated fitting; 

c) The fittings are of the AN type with class 3 precision threads, and 

d) The qualified design and processes developed for EURECA have been transferred to 
the CALIPSO spacecraft team with fidelity and rigor or that they have executed an 
equivalent qualification process. 


Site Visit Notes: 

Alcatel stated that the A/N fittings have Class 3 A precision threads. See NESC-R-001, 002 and 
004 for details on the other issues. 
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IPMC Action 13 (AETD request of March 1, 2004) 


The Project will conduct a Peer Review all of the lifting and handling procedures as well as 
the DPAF attachment procedures as they represent the highest risk activities once the 
spacecraft is fueled. 

Site Visit Notes: 

Jose Caraballo proposed the normal peer review process be augmented with 2 independent 
operational type personnel (Cramer suggests Jim Free and Steve Scott) to participate in the 
lifting procedure review for those involving the fueled spacecraft. These independent reviewers 
will report their results to AETD. 
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WSTF Proteus Propulsion Bus Hydrazine Material Compatibility 
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Calipso Materials Assessment for Contact with Hydrazine (N2H4) 
INTRODUCTION 

White Sands Test Facility (WSTF) was requested by the NESC to perform a quick material 
compatibility assessment of the Calipso spacecraft materials in contact with hydrazine. The 
analysis was performed with limited information on the materials and only a cursory 
understanding of the physical system. As such, the results presented are general in nature, 
except where specific material samples were received and tested. 

This assessment addresses the issue of incidental contact of hydrazine (liquid or vapor) with a 
list of materials from the Calipso craft provided by NESC personnel. The incidental contact 
scenario was specified by NESC personnel and would result from a leaking AN fitting. Note: 

No materials specification or certification sheets were provided for the initial assessment. 

Scrim fabric was added to the list after the preliminary results were delivered. A certification 
sheet was provided for it. It is understood these materials are not intended for long-term 
contact and are not used as materials of construction to contain hydrazine. 

The primary hazard from incidental contact is considered to be hydrazine decomposition as a 
result of material contact. This could be from catalytic decomposition or oxidation on material 
surfaces. Both mechanisms are exothermic and could result in fire and/or explosion hazards. 
Secondary hazards may result from material degradation but those are not assessed here as 
WSTF does not have sufficient information on the system. 

Toxicity hazards are not addressed as NESC personnel have indicated the system is instrumented 
with adequate monitoring protection to warn personnel of a release. 

BACKGROUND 

To determine the potential for fire hazard, it is necessary to 
assess the conditions that would create a fire. The familiar 
NFPA fire triangle is applicable in this situation. The fuel is 
leaked hydrazine. The oxidizer is the oxygen in ambient air. 
materials in question will be considered possible ignition 
sources for this assessment; however, thermal and electrical 
sources are also possible ignition sources. 

The lower flammability limit for hydrazine in air is 4.7% 

(v/v). At ambient conditions, hydrazine vapor in air is not flammable. The flash and fire points 
for hydrazine are both 124 F. The flash point is defined as the lowest temperature at which the 
liquid gives off enough vapor to form an ignitable mixture at or near the surface (Sax 1984). A 
sustained fire may not occur at the flash point but will at the fire point. The fire point is defined 
as the lowest temperature at which fire continuously burns, in still air, over a liquid surface upon 
exposure to an ignition source (Scott, Burns, Lewis, 1949). At ambient conditions hydrazine 
does not have a high enough vapor pressure to form a flammable mixture in 



Ign. Source 
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air. Thus, a potential ignition source will have to heat the hydrazine first and then still have 
sufficient energy to ignite a mixture. 

MATERIAL LIST 

The following is the list of material information provided to WSTF by NESC personnel. Below 
each name is a brief description of how and where the material is used in the spacecraft and the 
approximate mass or geometry. 

Metals 


Aluminum: 

Alloy: 

thruster bracket (200g*4) 

7075 T7351 

mounting web (20g*6) 

7075 T7351 

panel (lm , thickness 0.6mm) 

6061 T6 

half thruster thermal bracket ( 25g *4) 

7075 T7351 

lower frame ( 10kg) 

7010 T7451 


• Titanium: 

TA3 V tubing 

TA6V: tubing bracket (15g), pressure transducer (200g), filter housing (130g), 
screw 

• Copper: 

thruster thermal conductor (140g) 

• Stainless steel 

onduflex washer 

Non-Metals 


POM GF25 (polyoxymetylen): 
harness support (lg/supports) 

Epoxy base adhesive paste: 

insert bonding (2g/insert), CTA bounding 

polyester (velcro)+fixing ribbon: 

MLI fixing (1 g/support) 

ETFE: 

climping ring (blue): (2g) 

Paint: Aeroglaze Z306: 
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primer epoxy base / paint polyurethane (0.7m 2 , thickness 35 to 90 microns, 
150g/m 2 ) 

chotherm: 

conductive silicone elastomer fiber glass reinforced foil (thickness 0.38mm, 
616g/m 2 ) 

kapton (black & orange): 

4.5g/m for 50mm width 

chofoil aluminum +acrylic: 

10g/m 2 

MLI: 

external face: aluminized kapton (quasi all surface are covered with-see velcros-) 
CTA: 

2 

thermistance & heater (80*30mm each, 0.075g/cm ) 


• Scrim fabric 


ASSESSMENT 

Where noted, WSTF personnel researched a material name to better identify it for the 
evaluation. 

• Aluminum: Alloy: 

thruster bracket (200g*4) 7075 T7351 

mounting web (20g* 6) 7075T7351 

panel (lm 2 , thickness 0.6mm) 6061 T6 7075 

half thruster thermal bracket ( 25g *4) T7351 7010 

lower frame ( 10kg) T7451 

Aluminum is compatible with hydrazine. As Figure 1 (below) shows, aluminum results in 
a lower hydrazine decomposition rate than titanium. All alloys listed above are acceptable 
for incidental contact. Per Schmidt (pg 691), aluminum alloys are “acceptable for brief 
general service based on 7 to 90 day immersion tests.” In general, aluminum alloys should 
not represent a hazard from incidental contact with hydrazine. 

• Titanium: 

TA3 V tubing 

TA6V: tubing bracket (15g), pressure transducer (200g), filter housing 
(130g), screw 
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WSTF does not have data for these alloys as specified. TA3V and TA6V are assumed to 
stand for Ti-Al-3V and Ti-Al-6V respectively. In general, titanium-aluminum-vanadium 
alloys are considered to be compatible with hydrazine. 
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Figure 1. Relative Decomposition Rates of Hydrazine in Contact with Metals 

(Relative to Titanium. Data from AIAA-SP-084-1999 and/or WSTF test data.) 


• Copper: 

thruster thermal conductor (140g) 

Highly oxidized blue-green (patina) copper is considered incompatible with hydrazine. A 
demonstration performed at WSTF has shown that highly oxidized copper is a potential 
ignition source for hydrazine combustion. The copper oxide used in the demonstration had 
a high surface area. When the hydrazine liquid contacted the copper oxide, the hydrazine 
began to oxidize and release heat. The heat vaporized some of the hydrazine and created a 
flammable mixture in the air space. The hydrazine continued to react with the copper oxide 
to the point that the oxide was glowing and became hot enough to be an 
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ignition source for the flammable hydrazine/air mixture. The hydrazine vapor ignited in air 
and burned until the hydrazine was depleted. 


From a photograph provided to WSTF, the copper in the Calipso craft appears to be in the 
form of a braid. This presents a high surface area for incidental contact; however the 
surface does not appear to be highly oxidized. Additional information from the NESC 
indicated the copper had a tin coating. 

Without the tin coating, could the copper braid react with hydrazine vapor and act as an 
ignition source? Copper is a very good heat conductor so the base metal under the corrosion 
is going to be flowing heat away from the hydrazine reaction site. A thick oxide layer 
(patina) might be insulated enough for a localized hot spot to form. The copper does not 
appear to be highly oxidized and therefore, would not seem to be a credible ignition source. 
If as indicated by NESC personnel, hydrazine vapor contact is the only possible type of 
exposure given the braid location, then it is even less likely that a hot spot could form on 
the copper. 

No information was found for hydrazine reactivity with tin. 

• Stainless steel 

onduflex washer 

The washer material was described by NESC personnel as “decontaminated stainless steel 
Z6CN 18-09 (HV-350) Z6CN 18-09 (HV-350) is listed as a 303 designation stainless 
steel and is comparable to SS 304 on the chart. It is considered acceptable for incidental 
contact. 300 series stainless steels are generally considered compatible with hydrazine. 


Non-Metals 


• POM GF25 (polyoxymetylen): 

harness support (lg/supports) 

From an internet search, it was discovered that polyoxymetylen is the Swedish name for 
acetal, also known as Delrin®. It is not considered compatible, but not considered an 
ignition source either. It may degrade in hydrazine. 

• Epoxy base adhesive paste: 

insert bonding (2g/insert), CTA bounding 

In general, epoxies are not considered compatible, however, they not considered ignition 
sources either. Epoxy is a generic term and there are so many different formulations and 
fillers it is not possible to assess without testing. Very few epoxies have been tested because 
they are not considered compatible and do not warrant the expense. 


polyester (velcro)+fixing ribbon: 
MLI fixing (1 g/support) 
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Polyester materials should be susceptible to ammonolysis, which in this case should make 
them incompatible with all the hydrazines as well as ammonia. Schmidt discusses the 
hydrazinolysis of esters on page 425 and 426 and again on 710. The Cole Parmer chemical 
resistance chart shows a severe effect not recommended (D rating) for ammonia with Hytrel 
(a polyester) and a moderate effect (C rating) for hydrazine. The interaction between 
polyester and hydrazine is not considered to be an ignition source though the material will 
be degraded. 

• ETFE: 

climping ring (blue): (2g) 

One source on the internet (www.meyersplastics.com) indicated that Rulon® was a brand 
name for ETFE. KSC’s approved material list (KTI-5211) lists Rulon A as an ‘A’ rating, 
meaning it is acceptable for use within the described conditions (750 psig or less and 160 F 
or less). 

AIAA-084-1999, Table 15 lists Roulon J Film (misspelled?) as not compatible with 
hydrazine. A second entry for the same name indicates a significant weight loss and 
color change. This material is degraded by hydrazine but is not an ignition source. 

• Paint: Aeroglaze Z306: 

primer epoxy base / paint polyurethane (0.7m , thickness 35 to 90 
microns, 150g/m) 

Schmidt discusses some polycyanurate resins and their lack of compatibility with 
hydrazine on page 711. Based on the reactivity of polyesters and polyamides with the 
hydrazines and ammonia there is no reason to expect a polyurethane linkage to do any 
better. 

AIAA-084-1999, Table 15 lists a polyurethane topcoat that changed from a rigid coating to 
softened, flexible and wrinkled after 48 hrs exposure to hydrazine at 160 F. 

This material is not compatible, but probably not an ignition source. 

• chotherm: 

conductive silicone elastomer fiber glass reinforced foil (thickness 0.38mm, 
616g/m 2 ) 

Cured silicone is fine for incidental contact. Initially it was believed there was an additive 
to make it electrically conductive. Here conductive refers to thermally conductive so there 
is apparently no additive to make it electrically conductive. The silicone foil is conductive 
due to its suppleness that allows good thermal contact conductivity between a unit and its 
supporting structural panel. With fiberglass reinforcement it is considered acceptable for 
incidental contact. 
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Fiber glass entrained in a polymer is typically considered compatible with hydrazine. Fiber 
glass by itself represents a high surface area for air oxidation of hydrazine and can be an 
ignition source. 

• kapton (black & orange): 

4.5g/m for 50mm width 

Kapton is a polyimide and will dissolve in hydrazine. It is not an ignition source; however, 
loss of insulation on a wire could lead to an electrical ignition hazard or other electrical 
problems. 

• chofoil aluminum +acrylic: 

10g/m 2 

See comments on aluminum above. 

Acrylic has been subjected to a 2-hr screening test in hydrazine at ambient temperature 
(ref. LWO-680333, 09/13/95). The material had no effect on the hydrazine. 

• MLI: 

external face: aluminized kapton (quasi all surface are covered with-see velcros-) 

Assumed to stand for Multiple Layer Insulation. The MLI is composed of 7 layers and 6 
spacers as shown below: 



Number 

thickness 

material 

External face 
coating 

Internal face 
Coating 

External layer 

i 

25 |jm 

kapton 

none 

Aluminized 

Spacers 

6 

- 

billon 

- 

- 

Other layers 

5 

6 |im 

Mylar 

Aluminized 

Aluminized 

Internal layer 

1 

25 |am 

kapton 

Aluminized 

None 


See comments on aluminum above. 


See comments on kapton above. 


Billon - Pronunciation: (bil'wn), fkevl — n. 

1. an alloy used in coinage, consisting of gold or silver with a larger amount of base 
metal. 

2. an alloy of silver with copper or the like, used for coins of small denomination. 

3. any coin struck from such an alloy. 

The composition of ‘billon’ spacer material could not be identified, therefore, a sample of 
the MLI was submitted for compatibility testing. The report from this test is WSTF# 04- 
38718. This report is attached as Appendix A. In summary, a small section containing most 
of the components attached to the MLI was exposed to a small quantity (-10 ml) of 
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hydrazine. Several of the components dissolved or deformed upon exposure but did not 
ignite. Pre- and post-test photographs are included in the report. The hydrazine liquid 
changed color to yellow immediately upon exposure. 

• CTA: 

2 

thermistance & heater (80*30mm each, 0.075g/cm ) 

CTA is a French acronym for “Controle Thermique Actif ’ (Active Thermal Control). 

The materials of construction were not provided. Most thermocouples have a stainless 
steel sheath. Heaters can be a variety of configurations and materials of construction. 
Depending on materials and previous heat cycling, the surface may be oxidized and 
represent a possible ignition source. 

• Scrim fabric 

The material specification sheet for the scrim fabric identifies the material as metallized 
polyester/nylon. A note at the bottom says the material “has a silver reflective side.” It is 
unknown whether the metallized portion of the material really is silver or if it just looks 
that way. Two calls to the manufacturer on 09/08/04 to resolve the issue went unanswered. 
Assuming the metallized portion is silver (though it does not seem likely), the silver is a 
potential ignition source especially if the surface is oxidized. As with the copper, a high 
level of oxidation would be required to be a credible ignition source. 

Nylon is listed as ‘Not Compatible’ in SP-084-1999, Table 15, Effects of Hydrazine on 
Nonmetals (pg 68). Schmidt mentions Nylon specifically on page 710 as dissolving. 

See comments on polyester above. 

SUMMARY 

The tin coating on the copper braid material has not been precisely identified. No reactivity 
data for tin and hydrazine was found in the literature. A test for incidental contact exposure 
is recommended to verify this material will not pose a reactivity hazard. 

Within the constraints of the limited information received on the materials in question and 
the cursory understanding of the physical system, it is believed that there is little risk of fire 
resulting from an incidental contact of system materials with hydrazine. 
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Appendix A 

WSTF Report 04-38718 
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NASA WSTF TEST REQUEST 

Note to test facility: A copy of this request should be returned with test report. 


NAME 

Richard Gilbrech 


ORGANIZATION 


NASA/Langley Research Center 
Hampton, VA 23681-0001 


OFFICE USE ONLY 

TEST FACILITY I.D. NUMBER 

04-38718 

COORDINATOR 


REQUEST NO. 

WSTF 

TEST FACILITY 

WSTF 


DATE 

08/10/04 


(757) 864-3303 


1. MANUFACTURER’S IDENTIFICATION (Item Description) 

Proteus Propulsion Bus Multiple-Layer Insulation 


2. MANFACTURER’S NAME 

Alcatel Space Industries 
54, rue La Boetie 
75008, Paris, France 


3. SPECIFICATION 


4.CHEMICAL CLASS 

Assembly 


5. GENERIC USE 

MLI 


6. TEST DOCUMENT NASA-STD-6001 7. TEST REQUIRED NASA STD-6001 

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 VCM CTVS SPEC VAC BAKE 


8. VEHICLE 9. PART NO. & SERIAL NO. 10. PROJECT 11. USE TEMPERATURE 

G4S 


12. USE ATMOSPHERE/FLUID 13. IGNITER TYPE 


Hydrazine 


16. INTENDED APPLICATION 


14. USE PRESSURE 

Ambient 


15. USE THICKNESS 

As Received 


17. QUANTITY INHABITABLE AREA/HAZARDOUS FLUID/VACUUM 


18. CURE TIME 


19. CURE TEMPERATURE 


20. CURE PRESSURE 


21. TEST ARTICLE WEIGHT 22. TEST ARTICLE AREA 


23. NUMBER OF ITEMS TESTED 24. NUMBER OF ITEMS TO BE FLOWN 


25 TEST CHAMBER VOLUME I 26. TEST CHAMBER ATMOSPHERE I 27. TEST CHAMBER PRESSURE 28. TEST CHAMBER TEMPERATURE 


29. TEST CHAMBER DURATION 30. CLEANING SPEC 


31. MATERIAL CODE 32. PHOTOGRAPHIC COVERAGE 


□ VIDEO □ STILLS |/*\1 NONE 


33. SPECIAL INSTRUCTIONS 

Perform a Screening test (Beaker) in Hydrazine on a representative sample of the MLI assembly. 


WSTF Form 514 (Formerly JSC Form 2035) 
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Page 2 

WSTF # 04-38718 
WSTF 

NASA STD 6001 

TEST 15: REACTIVITY OF MATERIALS IN AEROSPACE FLUIDS 
SCREENING TEST 
NON-STANDARD TEST * 

ASSEMBLED ARTICLE 

Proteus Propulsion Bus Multi pie- Layer Insulation 

TEST ARTICLE DESCRIPTION 
Preparation Information 

The test sample was cut to contain all the layers of the insulation and 
most of the other components attached to the Proteus Propulsion Bus 
Multi pie -Layer Insulation. 

Pretest Photograph! s) : NASA-WSTF 0804e6471 0804e6477 
TEST CONDITIONS 

Test Environment: Liquid phase of hydrazine (N2H4) 

Test Temperature: Ambient 
Test Duration: 2 Hr 

TEST RESULTS, OBSERVATIONS. AND COMMENTS 
Pretest Weight: 0.738 g * 

Posttest Weight: 0.503 g 


Addendum 4-13 



Page 3 

WSTF # 04-38718 
WSTF 


TABLE 1. MATERIAL CHARACTERISTICS 


Component 

Pretest Observations 

Posttest Changes 

Proteus Propulsion 
Bus Multiple- Layer 

metallic, shiny, 
smooth, flexible, 
assembl y 

see below 

Velcro 

white, flexible, 
rectangular, solid 

wrinkled 

Wire 

silver, flexible, wire 

unchanged 

Thread 

white, flexible, thread 

unchanged 

Reddish Spacer (under 
thread) 

translucent, red, 
smooth, nontacky, 
truncated circle, solid 

dissol ved 

Tape (on edge of 
sample) 

translucent, orange, 
smooth, nontacky, 
adherent, solid 

dissol ved 

Multiple Insulation 
Layers 

opaque, orange and 
white sheets, 
flexible, smooth, 
nontacky, solid 

mottled, soft, 
wrinkled, partially 
dissol ved 


Note(s): The test sample discolored and partially dissolved in the test 
fluid. The test fluid became yellow in color and contained 
particulate. 


Posttest Photograph(s): NASA -WSTF 0804e6478 
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National Aeronautics and 
Space Administration 


wstf0804e6471 


Lyndon B. Johnson Space Center 
White Sands Test Facility 
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National Aeronautics and 
Space Administration 


wstf0804e6477 


Lyndon B. Johnson Space Center 
White Sands Test Facility 


5 


WSTFNo. 04-38718 



Proteus Propulsion Bus 
Multi-Layer Insulation 
Liquid N 2 H 4 Screening Test 15 


Pretest 

1 Grid Length = 0.5 cm 
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National Aeronautics and 
Space Administration 


wstf0804e6478 Lyndon " son 

White Sands Test Facility 


WSTFNo. 04-38718 
Proteus Propulsion Bus 
Multi-Layer Insulation 
Liquid N 2 H 4 Screening Test 15 



Posttest 

1 Grid Length = 0.5 cm 
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Addendum 5 


KSC Modeling Analysis of Hydrazine Leak Detection Systems for 

the CALIPSO Spacecraft 

Analysis and Report written by Rebecca Young (retired) 

Modified and Edited by Dale Lueck/YA-C3/321-867-8764 on January 10, 2005 
Introduction 

The CALIPSO spacecraft (Cloud- Aerosol Lidar and Infrared Pathfinder Satellite Observations) 
Proteus propulsion system contains four !4” A/N threaded fittings. This led to a concern about 
leakage of hydrazine (Hz) when the spacecraft is fueled 36 days before launch. For this reason, 
the NASA Engineering Safety Center (NESC) CALIPSO Independent Technical Assessment 
(IT A) requested that KSC perform a safety hazards analyses for the Hz leak detection system 
that will be used to monitor the CALIPSO spacecraft at the Vandenberg Air Force Base. The 
system consists of a Zellweger Model Single Point Monitor (SPM) and Sentry 5000 Hazardous 
Vapor Detection System (HVDS) for monitoring the Payload Processing Facility (PPF) ASO 
West High Bay. The SPM and the HVDS will be supplemented with an additional SPM or a 
Zellweger CM4, which is a 4-channel continuous monitor that will be located 4 feet from the 
spacecraft. The requested analysis includes two parts: (1) the effect of using various lengths of 
sample intake tubing on response time and concentration reading, using a Zellweger Model CM4 
sensor, and (2) the time required for the vapor from a leak source to reach a significant 
concentration that would threaten personnel in the area. The goal for the analysis is to ensure 
that the personnel can be safely evacuated, if a leak should occur. 

Instrument Analysis 

The best way to characterize the performance of any instrument is to test several of them using a 
set up similar to its application. In this case, no instrument was tested. However, KSC was able 
to obtain test data for a CM4 instrument that was calibrated to measure monomethyl hydrazine 
(MMH) vapors. The data was taken in the Wiltech Toxic Vapor Detection Laboratory for the 
purpose of using it in the Hypergolic Maintenance Facility at KSC. The MMH vapor 
concentrations used for the test were 15, 50, and 97 ppb. The intake tubing lengths were 1, 50, 
100, 150, 200, 250, 300, 350 and 400 ft. The intake tubing material was Teflon FEP, %-inch 
O.D and 3/ 16-inch I.D. 

It needs to be pointed out that the data was obtained using MMH not Hz. Therefore, it may not 
be accurate for the CALIPSO application. However, it can provide information on instrument 
performance and indicate the general trend of responses. 

It is also important to note that the data obtained is from only one CM4 instrument. Testing of 
several CM4 instruments would provide data with a higher confidence level. 
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Results for the concentration response of the CM4 versus tubing length are plotted in Figures 1, 
2, and 3. 


Response vs. Sample line length 



Figure 1. Concentration Response vs. Intake Tubing Length 

Figure 1 shows a decreasing concentration when longer tubing is used. In this figure, each data 
point plotted is an average of several data points. Relative to the values at 1 foot, the 400 foot 
tubing length responses are down by 41%, 50% and 52% for the 15, 50, and 97 ppb vapors 
respectively, with smaller decreases at shorter tubing lengths. 
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MMH 15ppb Teflon Tubing 



Figure 2. Response of a 15 ppb MMH Vapor vs. Intake Tubing Length 

Figure 2 is an expansion of Figure 1, at 15 ppb vapor concentration, for better viewing. 


Response Times vs. Teflon Tubing Lengths 



Figure 3 shows the response time, defined as the first response above baseline reported by the 
instrument (~10 ppb), for the three MMH concentrations using various lengths of tubing. Due to 
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the scattering of the data, all data points are plotted for better understanding of the instrument. 
The plot shows the longer the tubing, the longer the overall response time and the larger the 
scatter of data. Note that the scatter for the 15 ppb vapor is particularly large. 

Analysis of Time Required for a Leak to Achieve 10 PPB and LEL Concentrations 

KSC was provided with the following parameters for the analysis: 

For the PPF, the worst-case leak rate is 1 kg/hour, volume of the PPF Cell (ASO West High Bay) 

'J 'J 

is 105,600 ft (2990 M ),— the flow through air exchange rate is 4 changes per hour, the 
temperature is 72°F+ 3°F, and the relative humidity is 45+10%. 

For the SLC-2 white room, the worst-case leak rate is 10 g/hour, the volume of the white room is 
18300 ft 3 (518 M 3 ) with level 6 raised to the highest point, the flow through air exchange rate is 
30 changes per hour, the temperature is 62°F+ 5°F, and the relative humidity is 50+10%. 

Time needed for a facility to reach a specific concentration can be calculated from the following 
Equation 1 * . This equation assumes all leaked liquid is vaporized and the vapor is perfectly mixed 
with the facility air. 

C = _g_(l-e' nt ) + (Ci-C 2 ) e" m + C 2 (Equation 1) 

nV 

where: 

C = concentration in the space when completely mixed (m 3 /m 3 ) 

q = amount of pollutant added to the space (m 3 /hr) 

n = number of volume changes per hour 
V = volume of the space (m 3 ) 

t = time (hours) 

Ci = concentration in the space at start (m / m ) 

C 2 = concentration in the supply air (m 3 /m 3 ) 

The amount (q) of Hz added to the space can be calculated form the ideal gas law. For the PPF, 
assuming 1 kg/hour of liquid Hz is evaporated completely at 72°F, the volume of Hz vapor from 
the leak can be calculated from Equation 2. 

q = nRT/P (Equation 2) 

where: 

q = volume (liter) 

n = number of moles of Hz = 1000g/32g per mole 
R = universal gas constant = 0.082 
T = temperature (K°) = 295.4 K° 

P = atmosphere pressure (atm) = 1 atm 

1 http://www.engineeringtoolbox.com/37_120.html 
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q = (1000 / 32) x 0.082 x 295.4 /I = 756.96 liter /hr = 0.757 m 3 /hr 

For the PPF, the plots for concentration vs. time, from Equation 1, are shown in Figures 4, 5, and 
6 . 


Concentration of Hz With Leak of 1 kg/hr in PPF 
(First Second) 



Figure 4. Concentrations of Hz in PPF during First Second of Leak 


Figure 4 shows if there is a leak, the PPF will have a concentration of 10 ppb in 0.14 seconds and 
70 ppb in 1 second. The number of drops of Hz to yield 10 ppb and 70 ppb can be calculated as 
follows: 

Leak rate per hour = lOOOg 

Leak rate per second = 1000 / 3600 = 0.2778g/sec 

Take 20 drops are in 1 cc 

Take lcc liquid Hz equals 1 g (specific gravity of Hz is 1.004 
Drop for 70 ppb = 0.2778 x 20 = 5.56 (at the end of 1 second) 

Drop for 10 ppb = 5.56 11 = 0.79 (at the end of 0. 14 second) 

The calculation indicates the vapor from a few drops of liquid Hz could achieve a concentration 
well above the ACGIH TWA value of 10 ppb within 1 second. If the detector is placed close by 
the leak source and the alarm is set at 10 ppb, the time to alarm will be largely determined by the 
instrument response time. Therefore, it is paramount to ascertain the response time of the 
instrument, including any delays due to tubing length. 
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Concentration of Hz with Leak of 1 kg/hr in PPF 
(First 60 sec) 



Time (sec) 


Figure 5. Concentrations of Hz in PPF during First 60 seconds of Leak 

Concentration of Hz with Leak of 1 kg/hr in PPF 
(First 10 Minutes) 



Figure 6. Concentrations of Hz in PPF during first 10 Minutes of Leak 


For the white room, the plots for concentration vs. time from Equation 1, are shown in Figures 7, 
8, and 9. 
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Concentration (ppm) 


Concentration of Hz with Leak of 10 g/hr in White Room 
First 6 Seconds 



Figure 7. Concentrations of Hz in White Room During First 6 Seconds of Leak 


Concentration of Hz with Leak of 10 g/hr in White Room 
First Minute 



Figure 8. Concentrations of Hz in White Room During First Minute of Leak 
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Concentration of Hz with Leak of 10 g/hr in White Room 
First 10 Minutes 



Figure 9. Concentrations of Hz in White Room During First 10 Minutes of Leak 

As for the PPF, the calculation for the white room also shows that a leak can produce 
concentrations that exceed the 10 ppb TWA. It takes vaporization of only a fraction of a drop of 
Hz to yield this concentration. 

In general, the calculation shows that even a small leak can produce Hz vapor concentration 
above the TWA within a few seconds. The time for the instrument to alarm will depend on the 
response time of the instrument, plus any delays caused by long sample lines. 

The Microsoft Excel© spread sheet for the calculations is provided in Appendix A of this 
Addendum. 

Analysis for Potential Explosion 

In the case there is a leak on the AN fitting and assume all liquid accumulated in the canister, the 
Hz vapor pressure can be calculated from Equation 3 2 * relating the hydrazine equilibrium vapor 
pressure to the temperature of the liquid: 

Log p(mmHg) = -6.50603 - 653.880 + 0.047914 T - 4.9886 x 10' 5 T 2 (Equation 3) 

T 

TinK 0 

From Equation 3, the calculated vapor pressure of Hz at 295.37°K is 12 mmHg. 


2 Schmidt, Eckart, Hydrazine and Its Derivatives , 2 nd ed. John Wiley& Son, New York, 2001, p.189 
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The concentration in the closed canister can be calculated from the partial vapor pressure of Hz: 

12 mmHg / 760 mm Hg x 10 6 = 15,789 ppm or ~1.6% 

The above concentration is the maximum concentration that can be produced at 72°F, when the 
spacecraft is at PPF. As the temperature in the white room is very close to that of the PPF (62°F 
vs. 72°F), the maximum concentration that can be generated in the white room can also be 
considered ~ 1.6%. This concentration is below the Lower Explosive Limit of 4.7% 3 . 

Therefore, the possibility of explosion is low, if the only source of heating is from the room and 
no reactive materials are in contact with the hydrazine vapors or liquid. However, any external 
source of heat, or heat produced from reaction of the hydrazine, could quickly escalate the vapor 
concentration or produce a positive feedback leading to explosive concentrations. 

Conclusion and Recommendation 

The analysis of the CM4 data using MMH vapor showed concentration readings decreased as the 
sample intake tubing length increased. Therefore, one needs to consider the possibility that 
exposure to vapor concentrations of 10 ppb through long sample tubes may not trigger an alarm 
set at 10 ppb. The analysis also showed the instrument response time increases as the length of 
sample intake tubing increases. In addition to longer response time, the scatter of the data is 
greater for low concentration and long tubing. The scatter lowers the confidence in the 
performance of the instrument. To gain confidence in the instrument, it is recommended that we 
test the CM4 with Hz vapors using a set up similar to its intended use. Hz vapor of 
concentrations slightly above 10 ppb (12-15 ppb), 100 ppb, 1 ppm, and 50 ppm are 
recommended, along with sample tubing length of 1, 50 100, and 150 feet. 

The model used here to calculate vapor concentrations does not address the rate of vaporization 
of any leaked hydrazine liquid. The approach used assumes all liquid is vaporized and 
immediately is spread evenly throughout the enclosed volume of the room. A more sophisticated 
model would require detailed knowledge of many parameters to calculate the heat transfer into 
any spilled liquid and calculate the resulting evaporation rate, followed by an analysis of the air 
currents, convective transport, and diffusion of the resulting vapors. Such a study is well beyond 
the scope of the present work and would be subject to many assumptions that would significantly 
affect the outcome. What the current calculations do show is that a few drops of spilled 
hydrazine can produce concentrations exceeding the allowable TWA value of 10 ppb, even if the 
entire room volume is diluting the hydrazine vapor. Such an even distribution is rarely achieved, 
and it is wise to assume that both lower and higher concentrations would exist in the room, and 
would move in ways that could pose a hazard to unprotected personnel. Similarly, the 
equilibrium vapor pressure only shows that some source of external heating would be necessary 
to achieve the LEL for hydrazine, but even a small reaction site or a warm surface could 
drastically change the outcome to a far more dangerous situation. 

In summary, if an instrument such as the CM4, SPM, or Sentry 5000 is calibrated with Hz and is 
tested in a setup similar to its application, and can perform as expected, it would provide the best 


3 http://msds.ksc.nasa.gov/msds/07770/ 
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assurance for personnel safety. Setting the alarm to 10 ppb and monitoring within the spacecraft, 
close to the likely leak site, should provide an early alarm with sufficient time for personnel to 
safely evacuate the area. 
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Purpose : 

The KSC Applied Chemistry Laboratory conducted testing of the Zellweger Analytics 
model CM4 hydrazine vapor detector in support of an on-going assessment of personnel safety 
hazards associated with the CALIPSO spacecraft. Tests were designed to ascertain instrument 
accuracy and alarm response time upon exposure as well as the recovery time upon removal of 
hydrazine vapors at varying concentrations. The addendum contains additional testing requested 
to clarify response times at 1 ppm, delays caused by tape advance cycles, and some quick 
qualitative testing for some common interferences. Some of the conclusions in the main body 
are re-analyzed in the addendum as new incites into the testing protocol arose when comparing 
the data sets 

Introduction : 

The Zellweger Analytics model CM4 Toxic Gas Monitor is designed to continuously 
monitor toxic gases at four different points up to 300 feet away using chemcassette technology. 
The chemcassette consists of a paper tape reel dosed with a chemical indicator specific to the 
toxic gas in question. An internal pump draws vapors at a designated flow rate through four 
separate sampling tubes to react with the paper tape. Four stationary optic sensors are located at 
the reaction sites of respective sampling points on the paper tape. Each sensor has integrated 
audio and visual alarms that may be set manually for upper and lower concentration levels. The 
lowest alarm concentration level is the TLV (Threshold Limit Value) for the vapor in question 
(10 ppb for hydrazine). 

Sampling cycle times are dictated internally by the concentration of toxic vapor detected. 
A sampling cycle involves advancing the chemcassette to present unexposed substrate tape to the 
four sampling points. The tape may be advanced automatically as dictated by the instrument or 
may be forced manually. One fresh chemcassette provides approximately one month of 
unattended continuous monitoring without the occurrence of a major gas event. If a gas release 
does occur, the instrument reports an alarm and advances the tape to expose virgin substrate tape 
and continues monitoring. Thus, the sampling cycle time decreases and the tape advances more 
quickly. Therefore, in the event of a hydrazine leak, the tape is consumed more rapidly and 
necessitates earlier replacement. 

The CM4 is "gas tested" for proper response by Zellweger Analytics. An optics 
verification card is provided for the user to confirm that the optics are functional. The user is 
otherwise unable to calibrate the instrument. 

Testing was conducted to determine the accuracy of the instrument's concentration 
measurements, the alarm response time upon exposure to hydrazine vapors, and the instrument's 
recovery time upon removal of said hydrazine vapors. Tests were conducted with an alarm 
setting of 10 ppb for four different tubing lengths (5, 50, 100, and 150 ft.) at four different 
hydrazine concentrations (12, 150, 1000, and 50,000 ppb). 
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Experimental Methods ; 

All testing was conducted in Hood 1 of the Applied Chemistry Laboratory (ACL) in the 
O&C building at Kennedy Space Center. The Zellweger Analytics CM4 detector was provided 
to the ACL by the United Space Alliance (USA). 

Hydrazine vapors were generated using Kin-Tek vapor standard generators. Miller- 
Nelson Flow Controllers provided humid air for mixing with the hydrazine vapors to the 
designated concentrations. Hydrazine vapors were transported via Teflon tubing to a mixing 
tube where they were allowed to equilibrate with the humid, dilution air. After equilibration, the 
sample tubes were inserted directly into the mixing tube. The actual concentrations of the 
hydrazine vapors were verified before and after dilution using the ACL Standard Laboratory 
Procedure 4.2, "Determination of Concentrations of N 2 H 4 vapor in Nitrogen or Air by the 
Coulometric Titration Method". 

The 1/4" OD x 3/16" ID FEP sampling tubing obtained from Zeus Industrial Products 
was prepared upon receipt by initial rinsing with deionized H 2 O followed by an isopropyl 
alcohol rinse. Finally, gaseous N 2 was flushed through the tubing. After cleaning, the tubing 
was cut to the desired lengths: four 5 ft, four 50 ft, four 100 ft, and four 150 ft. pieces. 

The concentrations (12, 150, and 1000 ppb) and tubing lengths (5, 50, 100, and 150 ft.) 
were analyzed at least four times each for repeatability. The 50,000 ppb tests were necessary as 
50,000 ppb (50 ppm) is the OSHA Immediate Danger to Life and Health (IDLH) threshold for 
hydrazine. However, they were performed only once and for shorter exposure times for each 
tubing length for several reasons. One reason was to avoid endangering the experimenter. 
Another reason was that the upper detection limit of the CM4 for hydrazine is 1000 ppb. 
Considering the "sticky" nature of hydrazine vapors, repeated extended exposure of the 
instrument to these high-level hydrazine concentrations could contaminate the instrument optics 
rendering the CM4 inoperable and preventing completion of the testing. Moreover, it was noted 
upon initial testing of the 50,000 ppb vapors that the alarm response was almost instantaneous 
upon exposure. In fact, the brief delay reported in the response time results was due to the 
manual tape advancement. Introduction of this experimental error was necessary in order to 
insert the tubing and capture the alarm response. Consequently, the four points obtained from 
each single 50,000 ppb trial were deemed sufficient for repeatability in this study. 

Each time the CM4 was powered ON, the "quick start procedure" was performed and the 
lower alarm levels for each sampling point were set to 10 ppb. The "optics verification" was 
executed daily. The flows through each sampling tube were adjusted to 180 cc/min prior to each 
test run as considerable drift in the flow rates was noted over time. The aforementioned 
procedures were conducted as directed in the CM4 Operator's Manual. 

After allowing the hydrazine vapors to equilibrate to the designated concentration in the 
mixing tube, the flows for each sampling point are adjusted to 180cc/min. Next, the CM4 is set 
to monitor mode with the sampling tubing exposed to fresh air for ten minutes to establish a 
stable zero baseline. Once a baseline is established, the sampling tubing is inserted directly into 
the mixing tube while simultaneously advancing the chemcassette tape manually and initiating 
the data collection software. 
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The sampling tubing is exposed to the hydrazine vapors within the mixing tube, the 
exposure time is recorded and the sampling tubing is withdrawn from the mixing tube. Then the 
tubing is exposed to fresh air while simultaneously advancing the chemcassette tape manually. 
The CM4 remains in monitor mode until a 0 ppb concentration reading is recorded for all four 
points. A typical plot of the instrument response will suddenly drop to zero because the CM4 is 
programmed to auto-zero when the concentration falls below 8 ppb. This also prevents any 
meaningful measurement of the instrument baseline noise. 

Results : 

Figure 1 is a graphical representation of the CM4 alarm times versus the sampling tubing 
length at each concentration. The alarm level was set at the hydrazine TLV of 10 ppb. One 
clearly observable trend is the decrease in alarm response time with increasing exposure 
concentrations. A second noticeable trend is an increase in alarm time with increasing tubing 
length. This trend is dramatic at low concentrations and nearly indistinguishable at 
concentrations of 1000 ppb or more. 


CM4 Alarm Times vs. Sample T ube Length 



Sample Tube Length, ft 

Figure 1. CM4 Alarm Time vs. Tubing Length at Various Hydrazine Concentrations 
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Fallback time is defined as the time required for the CM4 to return to a zero ppb baseline 
following exposure to hydrazine vapor. Trends in the fallback time are less clearly defined than 
those of alarm times. Figure 2 is a plot of fallback time versus tubing length at each 
concentration. At lower concentrations, the tubing length appears to have little effect on the 
fallback time. Also, we observed a tendency for the fallback times to increase with increasing 
hydrazine concentration exposure. Fallback time behavior is erratic at hydrazine concentrations 
of 1000 ppb and especially at the higher 50,000 ppb concentration. It is important to note while 
studying Figure 2 that the duration of exposure of the 50,000 ppb hydrazine vapors through the 5 
ft. tubing was for 5 minutes while the 50,000 ppb exposures through the 50, 100, and 150 ft. 
tubing were for 1 .5 minute durations. This modification was made with time constraints 
following the observation that it may take up to 128 minutes following a 50,000 ppb exposure to 
fallback to 0 ppb. This was the maximum fallback time observed in the 5 ft tubing trial. 

The unpredictable fallback times at higher concentrations are likely due to the 
aforementioned "sticky" nature of hydrazine vapors. Residual hydrazine may adsorb within the 
sampling tubing or on the detector optics during exposure and require more time to be flushed 
from the system. Several experiments were conducted to elucidate a correlation between 
exposure time and fallback time. It was determined that duration of exposure has little effect on 
fallback time at low hydrazine concentrations (< 150 ppb). In contrast, fallback time does 
increase with increasing exposure duration at hydrazine concentrations of 1000 ppb or higher. 
This was demonstrated by the extended fallback time of the 5 minute 50,000 ppb exposure 
through the 5ft. tubing versus the 1.5 minute exposures of the same concentration through the 50, 
100, and 150 ft tubing. Additional experiments were conducted to determine if hydrazine 
residue accumulating in the sampling tubing from previous tests affected the fallback times of 
later test runs. No decrease in the fallback or alarm times was observed when fresh tubing was 
used. 



Figure 2. CM4 Fallback Time vs. Tubing Lengths at Various Hydrazine Concentrations 
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The average CM4 alarm response and fallback times are presented in Tables 1 and 2 
respectively. 


Table 1. Average CM4 Alarm Times for Various Hydrazine Concentrations and Sampling 

Tubing Lengths 


Tubing length, ft 

Average alarm time, min 

12 ppb 

150 ppb 

1,000 ppb 

50,000 ppb 

5 

10.53 

1.78 

0.64 

0.55 

50 

10.65 

1.99 

0.63 

0.55 

100 

11.01 

2.26 

0.69 

1.87 

150 

16.90 

2.44 

0.70 

0.67 


Table 2. Average CM4 Fallback Times for Various Hydrazine Concentrations and 

Sampling Tubing Lengths 


Tubing length, ft 

Average fallback time, min 

12 ppb 

150 ppb 

1,000 ppb 

50,000 ppb 

5 

11.23 

20.57 

39.88 

91.26 

50 

11.45 

22.29 

46.66 

59.59 

100 

11.30 

21.78 

43.22 

30.80 

150 

14.57 

23.67 

42.62 

56.89 


Concentration response for hydrazine vapors of 1000 ppb or greater are beyond the 
capabilities of the CM4. The average CM4 concentration response for 12 and 150 ppb hydrazine 
vapors are presented for each tubing length along with the respective percent errors in Table 3. 
Most notable is that all reported concentrations are above the known concentration standard used 
in the testing. This seems to be a systematic error in the instrument calibration, which can not be 
adjusted by the operator. However, from the standpoint of industrial hygiene and worker 
protection, the error is on the side of safety. The instrument will alarm earlier and report higher 
concentrations than the actual instrument exposure. The concentration response clearly 
decreases with increasing tube length. However, the percent error is not consistent for any given 
tube length for hydrazine concentrations of 12 and 150 ppb. Also, the percent error increases 
significantly with increasing concentration at a given tubing length with a 69.3% error at 150 ppb 
through 5-ft. tubing as compared to a 35.8% error at 12 ppb through the 5-ft. tubing. 
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Table 3. Average CM4 Concentration Responses at Various Tubing Lengths and their 

Associated Percent Error 


Tubing length, 
ft 

12 ppb 

150 ppb 

Avg. CM4 response, 
ppb 

% Error 

Avg. CM4 response, 
ppb 

% Error 

5 

16.3 

35.8 

254 

69.3 

50 

17.2 

43.3 

230 

53.3 

100 

14.1 

17.5 

224 

49.3 

150 

12.8 

6.67 

220 

46.7 


Figure 3 illustrates a decrease in the CM4 concentration response with increasing tube 
length when exposed to 12 and 150 ppb hydrazine vapors. Concentration response for hydrazine 
vapors of 1000 ppb or greater are beyond the capabilities of the CM4. The response for these 
hydrazine vapor concentrations lying within the range of the CM4 suggest that the additional 
surface area presented by the longer tubing is responsible for the decreased concentration 
response. The longer tubing would provide additional adsorption sites for the hydrazine vapor, 
thus decreasing the concentration of the vapors reaching the detector and resulting in a lower 
concentration response. If this were the case, one would expect to see a more pronounced effect 
at the lower concentrations. The data seems to support this theory, as we see a larger change in 
the 12 ppb response with increased tubing length than we do with the 150 ppb samples. 
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Concentration Readout of Zellweger CM4 
at 12 and 150 ppb hydrazine 
with 1 a error bars (SDOM) 



Length of FEP Sample Tubing, Feet 

Figure 3. CM4 Concentration Response vs. Tubing Length with Hydrazine Exposure 

In addition, hydrazine vapor has the ability to permeate through Teflon tubing. In fact, 
this property is utilized at high temperatures by the Kin-Tek vapor standard generators that 
furnish the hydrazine vapors for these experiments. Therefore, a second possibility is that the 
additional area provided by the longer tubing provides more area for permeation of the hydrazine 
vapors. This too would result in the observed decreased concentration response. Further testing 
would be required to determine the actual source of the varying concentration response. 

Since the instrument is calibrated by the manufacturer, it is possible that the actual 
concentration of the vapors used for calibration were lower than the reported values. This could 
have been caused by either tubing absorption (caused by dirty or incompatible tubing) or reaction 
of the vapors with the sample tubing or other materials used in the manufacturer’s vapor 
generation system (such as metallic materials which oxidize hydrazine vapors in the presence of 
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oxygen). In either case, the result would be low response at the manufacturers calibration, and a 
higher reported concentration when properly analyzed vapor streams are presented by others. 
This seems to be the case in our lab results, as all the reported concentrations are above our 
known, analyzed vapor concentrations. 

Conclusions : 

The CM4 Toxic Gas Monitor is capable of detecting a hydrazine release of 10 ppb or 
higher. A hydrazine release of 12 ppb may be detected in as little as 1 1 minutes or as long as 26 
minutes. Vapors of 1000 ppb concentration or higher alarmed much more quickly, and in < 40 
seconds for most samples. Inspection of the raw data presents an apparent discrepancy between 
the analysts observation that < 5 second alarm times seemed to occur for high concentration 
samples. Because of the protocol adopted for the low concentration (necessitated by variable 
sampling cycle times occurring with automatic tape advancement), we forced the tape to advance 
manually to eliminate the initial variable time period. This gave good results on the low 
concentrations where the -40 seconds delay imposed by the manual advance had little effect on 
the 10-20 minute response times at 12 ppb. However, the same protocol at high concentrations 
(1000 and 50,000 ppb) introduced these same delays into a very fast instrument response. We 
also observed that the sample tubes would pick up diluted hydrazine vapors as soon as the 
sample tube approached the hood face (with 50 ppm samples), well before insertion into the 
hydrazine vapor flow. Attempts to do rapid connections and simultaneous data triggering gave 
highly variable results due to the aforementioned pre-insertion alarms and delays in connecting 
some of the tube fittings. 

NOTE : Further testing on the alarm times at higher concentrations was done in the 

Addendum at the end of this report. Please refer to those results for further 
discussions. 

The CM4 should be considered a qualitative rather than quantitative vapor detection 
instrument, due to the consistently high readings obtained at all on-scale concentrations. . The 
concentration response of the CM4 decreases with increasing sample tubing length. This 
decrease is observed with clean tubing in a laboratory environment. Larger decreases would be 
expected if the tubing is not cleaned regularly or becomes contaminated with dust of other 
hydrazine absorbents. Consequently, the shortest possible length of tubing is preferable. 
Considerations to minimize the sample tubing length should be made when placing this 
instrument for use in monitoring hydrazine vapor releases. 

The CM4 may take as long as 128 minutes to return to a zero baseline following 
detection of high concentration hydrazine vapor release. This limitation may present significant 
delay in confirming that a faulty seal has been repaired properly, although cleanup and 
decontamination from any spills would also be lengthy procedures. If delays in cleanup 
confirmation are an issue, a second instrument could be used after cleanup and portable 
instruments used to confirm that hydrazine is no longer present. Separate cleaning and drying of 
the sample tubing might perform the same function (see tubing cleaning procedure on page 6-3, 
Experimental Methods, paragraph 3). 

Also, it is not known whether extended exposure to highly concentrated hydrazine vapors 
will damage the instrument beyond repair as exposure to these vapors during testing was limited 
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to brief periods as previously discussed. In the event of a major gas release it would again be 
advisable to have a second instrument on hand. 

Addendum: 

Further testing of the CM4 was requested for potential interferences (cigarette smoke, 
isopropyl alcohol, and perfume) that might cause False Positives and to confirm our less-than-5- 
Second Response Time observations for high concentrations. Since the manual tape advance 
times were observed to be long compared with the alarm response times suggested in the report, 
the tape advance times for both manual advance and automatic advance were timed to clarify 
their impact on instrument alarm times as well. Due to the occurrence of some alarms from the 
instrument when sampling at the face of the fume hood while generating 50 ppm concentrations, 
it was deemed sufficient to test only at the 1 ppm levels to avoid possible lab worker exposures. 

Tape Advance Times: 

Alarm times in the main body of the report were measured after a manual tape advance to 
eliminate large variations in alarm times observed in preliminary testing at low concentrations. 
These variations were largely associated with the random tape advance cycle at low 
concentrations that would occur, causing a new cycle to begin every 10 minutes, even if we were 
approaching an alarm signal from an applied 12 ppb sample. This technique allowed the analyst 
to attach the four sample tubes, and start the data acquisition system to do the data recording 
from which the alarm times were extracted. This worked well for the 12 ppb samples where the 
added 35-40 second manual tape advance cycles were small compared with the 10-20 minute 
alarm times being measured. However, at the higher concentrations, the manual tape advance 
cycle could cause problems in measuring these much shorter alarm times. 

The tape advance times for both manual tape advance and automatic (machine initiated) 
tape advance times were measured with a stop watch. 


Test: 

Tape Advance 

Time in Seconds * 

1 . 

Automatic Advance 

5 

2. 

Manual Advance 

35 

3. 

Automatic Advance 

4 

4. 

Manual Advance 

37 

^Measured with stopwatch 


The measured tape delay times confirm that a significantly longer delay occurs with a 
manual tape advance over an automatic tape advance. The 5 second or less automatic advance is 
a minor delay for high concentrations, but should be considered as potentially adding to the 
observed alarm times in this report, as we always started alarm time measurements after a tape 
advance. 
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Interferences: 


Other types of hydrazine analyzers have been observed to produce false alarms under 
some circumstances. Cigarette smoke produces a color change on hydrazine dosimeter badges 
mounted in the breathing zone of smokers, as it should, since cigarette smoke contains 
hydrazine, as well as several other carcinogens. For CALIPSO, we are mainly concerned with 
smoke residue, since smoking will not be allowed near the spacecraft. Isopropyl alcohol (IP A) 
causes false alarms in electrochemical hydrazine analyzers where some impurity in IPA is likely 
the cause. Some contaminant in IPA can apparently be oxidized by electrochemical cells at the 
TLV level for IPA (400 ppm). On a 10 ppb HZ analyzer, the contaminating compound is about 
equal to 20 ppb HZ for a 400 ppm IPA concentration. Even higher concentrations of IPA occur 
in hypergol operations, where IPA is used to rinse out HZ residues in fuel manifolds and tanks 
following testing of these systems. Concerns about perfume have not been documented in 
laboratory experiments, but are supplied here to alleviate potential concerns with the CM4. 

These tests were performed by placing the candidate interference on an absorbent wipe inside a 
polyethylene Ziploc bag, and then inserting the sample tube into the bag to draw off a saturated 
vapor sample. The cigarette smoke sample was done by enclosing a lab coat purposely infused 
with smoke into a similar bag as a worst-case scenario. The absorbent wipe alone was done as a 
control sample in case any alarms occurred to eliminate the wipe as a cause. 


Test: 

Potential Interference 


Analysis 

Time 

(minutes) 

Results 

5. 

Absorbent Wipe in 3 Gallon Plastic Bag 

Sample Background 

22 

No signal 

6. 

91 % Isopropyl Alcohol (IPA) on 
Absorbent Wipe in 3-L. Plastic Bag 

Less Pure Grade 

60 

No signal 

7. 

2-Propanol (IPA), ACS Grade 99.5+%, 
Absorbent Wipe in 3-L. Plastic Bag 

Higher Purity 

20 

No signal 

8. 

Lab Coat in 3-L. Plastic Bag 

Sample Background 

12 

No signal 

9. 

Cigarette Smoke on Lab Coat 
in 3-L. Plastic Bag 

2 Brands puffed into 
plastic bag with lab coat 

22 

No signal 

10. 

Perfume Spayed on Absorbent Wipe 
in 3 L. Plastic Bag 

Endless Fun for Women: 
Euro Collection 

20 

No signal 


None of the potential interferences tested produced a signal for hydrazine in these tests. 

Confirmation of Alarm Times at 1 PPM Concentrations 

Due to the delays in the manual tape advance when measuring the alarm times for the 1 
ppm and 50 ppm concentrations, we reported that the actual alarm times appeared to be much 
shorter than the times recorded by the data acquisition system. In fact, on the 50 ppm samples, 
alarms were occasionally observed while the analyst attempted to hook up the tubing inside the 
hood, but had not yet made a connection. Christy felt that these high concentrations would alarm 
in less than 5 seconds in many cases. Here we attempt to confirm this observation with a 
modified timing procedure which eliminates the tape advance delays so dominant at short alarm 
times. 
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The modified procedure is as follows: 

1) Wait for the automatic tape advance on the preceding zero baseline to occur. 

2) With stop watch in hand, rapidly insert two sample tubes into the open HZ source tube 
and start the stop watch simultaneously. 

3) Manually time the delay to the first audible alarm from either tube. 

This procedure should produce timing accuracies of about +1 second, we judged. The 
results are shown below. 


Tests 1 

-13 were done on January 27, 2005. Tests 14 - 22 were done on January 28. 

Test: 

Response To 1 ppm HZ with 150’ Tubing 

Alarm Time (minutes) 

Previous Work 


1-27-05 Automatic tape advance 



11. 

Time to alarm: Automatic tape advance 

1.50 min, to alarm 

0.62 - 0.87 min. 

12. 

Time to alarm: Automatic tape advance 

0.72 min. (43 sec.) to alarm 

0.62 - 0.87 min. 

13. 

Time to alarm: Automatic tape advance 

0.72 min. (43 sec.) to alarm 

0.62 - 0.87 min. 


1-28-05, after all night purge of tubing 
with room air via CM4 pump operation 



14. 

Time to alarm: Automatic tape advance 

1.58 min. (96 sec.) to alarm 

0.62 - 0.87 min. 

15. 

Time to alarm: Automatic tape advance 

1.45 min. (87 sec.) to alarm 

0.62 - 0.87 min. 

16. 

Time to alarm: Automatic tape advance 

0.66 min. (39 sec.) to alarm 

0.62 - 0.87 min. 


Test: 

Response To 1 ppm HZ with 50’ Tubing 

Analysis Time (minutes) 

Previous Work 

17. 

Time to alarm: Automatic tape advance 

0.33 min. (20 sec.) to alarm 

0.51 - 0.84 min. 

18. 

Time to alarm: Automatic tape advance 

0.175 min. (10.5 sec.) alarm 

0.51 -0.84 min. 

19. 

Time to alarm: Automatic tape advance 

0.38 min. (23 sec.) to alarm 

0.51 - 0.84 min. 


Manual tape advance 



20. 

Time to alarm: Manual tape advance 

0.875 min. (52.5 sec.) to alarm 

0.51 - 0.84 min. 

21. 

Time to alarm: Manual tape advance 

0.85 min. (5 1 sec.) to alarm 

0.51 - 0.84 min. 

22. 

Time to alarm: Manual tape advance 

0.88 min. (53sec.) to alarm 

0.51 - 0.84 min. 





Points 1 & 2 activated 

Set MATLAB to draw at 1 second 

11-13 Suggest that optics may need to have one exposure to ‘condition’ the sensor with successive responses taking less time. 
(?) Past testing showed that this first ‘slow’ response is independent of tubing 


The surprisingly long and variable alarm times caused the analyst to repeat the Manual 
tape advance protocol to ensure nothing had changed. The manual advance times show results at 
the top end of previous results, and a quite tight total variation in times. 

Discussion and Conclusions : 

The data on the tape advance delay show a substantial increase in time for the manual 
advance. Typical manual advance times were over 35 seconds, with automatic advance 
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occurring in < 5 sec. The crude interference testing shows no detectable interference for 
isopropyl alcohol (IP A) either in low purity or high purity versions. Likewise, no interferences 
were found for cigarette smoke on a lab coat or a variety of perfumes. 

The data taken to confirm a <5 sec response time at 1 ppm did not show times below 10 
seconds. When done with automatic advance with exposure beginning just after a tape advance, 
the delay times averaged 66 sec. with a standard deviation of 27 sec. (range of 39 to 96 sec.) for 
the 150-foot sample tube. The 50-foot sample tube averaged 18 sec., with a standard deviation 
of 7 sec. Using a modified manual advance procedure on the 50 foot length (timing and tape 
advance were started after tubing insertion), the times were much more consistent (average: 52 
sec., standard deviation 1 sec.). The difference in average times at 50 feet between automatic 
and manual tape advance seems to reflect the difference in tape advance times discussed above, 
and this would be expected since the alarm is inhibited during the 35 second manual tape 
advance cycle. 

In view of these results, it appears we will withdraw our conclusion that alarm response 
times below 5 seconds will occur with 1 ppm vapor concentrations. Explaining the variations in 
alarm times requires some more detailed analysis of the experimental procedures and hidden 
causes for delays or other effects. 

Why were shorter alarm times seen with the slower manual advance? 

The manual advance procedure, as used in the initial data, has a more complex and 
variable sequence of events: 


Event/Time (sec) 

5 

10 

15 

20 

25 

30 

35 

40 

45 

50 

55 

60 

65 

70 

Manual Advance 





1 








Insert tubes 













Alarm Time 





■ 

1 1 

1 i 

1 1 

1 1 

■ 






Note that the tubing is attached and drawing sample before the timing has been started. 
This allows the tubing to be conditioned by the entering hydrazine vapor before we actually start 
the timing. Some tubing will have a head start if it was inserted into the vapor earlier in the 
insertion window, or hydrazine exposure occurs before the actual insertion (area represented by 
light blue bar). These effects will shorten the apparent time to alarm. We believe these effects 
explain why shorter times were observed for manual tape advance sequences in the pre-Jan 27 
data. 

Why were the alarm times for automatic tape advance so variable? 

Upon closer examination, the longer alarm times at 150-foot length (in addendum) 
always occurred at the beginning of a test sequence. This would be in keeping with the tubing 
requiring more time to alarm when the surface has not been pre-conditioned by earlier HZ 
exposure. Run #11 was the first hydrazine exposure in several days. Runs 14 and 15 followed 
an all-night purge by room air when the instrument was left running over night with the tubing 
attached. Here we would not only remove any hydrazine residuals occupying active adsorption 
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sites on the tubing, but also introduce a potential dust residue to further adsorb hydrazine vapors. 

Re-cleaning of the sample tubing might have prevented a second long alarm time. 

Follow on measurements were within times for the earlier testing. These results should warn 
potential designers and users that alarm times on a system that has not seen any hydrazine 
recently, or is dirty with dust and particulates, will take much longer to alarm than fresh, clean 
tubing that had some hydrazine exposure earlier in the day. Alarm times up around 90 seconds 
appear to be the norm for 150-foot tubing without recent conditioning by hydrazine vapors. 

The following Appendix contains Tabulated data summary for all exposure runs. 
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Addendum 6 

Appendix: Tabulated Data Summary for All Exposure Runs 


This spreadsheet contains data from testing a Zellweger CM4 analyzer on hydrazine for response time 
with various FEP tubing lengths and HZ concentrations of 12 & 150 ppb, 1 and 50 ppm. 

All data done for Calipso spacecraft paid for by NESC, Nov-Dec 2004 


HZ Cone Length 


Cone Readout Analysis 


hz12test23 

hz12test25 

hz12test26 

hz12test27 


hz12test30 

hz12test31 

hz12test33 

hz12test34 

hz12test35 

hz12test36 

hz12test38 

hz12test39 

hz12test40 

hz12test41 

hz12test42 

hz12test44 

hz12test45 

hz50test03 


hz50test07 


hzl 50test1 0 
hzl 50test1 1 

hzl 50test1 3 
hzl 50test14 
hzl 50test1 5 
hzl 50test1 6 
hzl 50test1 8 

hzl 50test20 
hzl 50test21 
hzl 50test22 
hzl 50test23 
hzl 50test24 

hzl 50test26 
hzl 50test27 
hzl 000test4 
hzl 000test5 
hzl 000test6 
hzl 000test7 
hzl 000test9 
hzl OOOtestl 0 
hzl OOOtestl 1 

hzl OOOtestl 2 
hzl OOOtestl 3 
hzl OOOtestl 4 
hzl OOOtestl 5 
hzl OOOtestl 6 
hzl OOOtestl 7 
hzl OOOtestl 8 
hzl OOOtestl 9 


12ppb5ft-1.jpg 

12ppb5ft-2.jpg 

12ppb5ft-3.jpg 

12ppb5ft-4.jpg 

12ppb5ft-5.jpg 

12ppb50ft-1.jpg 

12ppb50ft-2.jpg 

12ppb50ft-3.jpg 

12ppb50ft-4.jpg 

12ppb50ft-5.jpg 

12ppb100ft-1.jpg 

12ppb100ft-2.jpg 

12ppb100ft-3.jpg 

12ppb100ft-4.jpg 

12ppb150ft-1.jpg 

12ppb150ft-2.jpg 

12ppb150ft-3.jpg 

12ppb150ft-4.jpg 

12ppb150ft-5.jpg 

150ppb5ft-1.jpg 

150ppb5ft-2.jpg 

150ppb5ft-3.jpg 

150ppb5ft-4.jpg 

150ppb5ft-5.jpg 

150ppb5ft-6.jpg 

150ppb5ft-7.jpg 

150ppb5ft-8.jpg 

150ppb5ft-9.jpg 

150ppb5ft-10.jpg 

150ppb5ft-11.jpg 

150ppb50ft-1.jpg 

150ppb50ft-2.jpg 

150ppb50ft-3.jpg 

150ppb50ft-4.jpg 

150ppb50ft-5.jpg 

150ppb100ft-1.jpg 

150ppb100ft-2.jpg 

150ppb100ft-3.jpg 

150ppb100ft-4.jpg 

150ppb100ft-5.jpg 

150ppb100ft-6.jpg 

150ppb150ft-1.jpg 

150ppb150ft-2.jpg 

150ppb150ft-3.jpg 

150ppb150ft-4.jpg 


1000ppb5ft-2.jpg 


1000ppb100ft-2.jpg 

1000ppb100ft-3.jpg 

1000ppb100ft-4.jpg 


50ppm50ft-2.jpg 

50ppm100ft-2.jpg 

50ppm150ft-1.jpg 



259 251 264 263 
273 267 281 276 
229 228 238 219 
247 250 249 245 


239 215 230 



)00 1000 
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CALIPSO Fire Protection Assessment 

Michael B.Stevens, P.E. 

KSC Authority Having Jurisdiction 
TA-G 

This assessment will demonstrate that personnel can evacuate the CALIPSO processing facilities 
with negligible risk of injury from fire should a hydrazine leak occur. 

Assumptions 

1 . Hydrazine leakage form a point source at a constant rate of 1 Kg/hour. 

2. Surrounding air is static with no purge. 

3. Equal dispersion of the hydrazine vapor. 

4. Materials in the vicinity of the leak are hydrazine-compatible (data from WSTF materials 
analysis). 

5. Hydrazine detection system is enabled and properly configured to detect leakage. 

6 . Detector alarm will sound within 40 seconds of sense tube exposure to a 1 ppm source 
(data from KSC Applied Chemistry lab test of Zellweger Analytics Model CM4 
hydrazine detector with 50-foot maximum sense tube length). 

7. Personnel evacuate at an average speed of 3 mph (leisurely walk). 

8 . Worst-case evacuation distance 120 feet (Astrotech facility data). 

Given 

1. Lower Explosive Limit (LEL) of hydrazine is 4.7% = 47,000 ppm 

2. Hydrazine = N 2 H 4 

3. Molecular weight N 2 H 4 = m N 2 H 4 =32 

4. Molecular weight Air = m a ; r = 28.6 

5. Mass density Air = p air = 1 -2 

Time Required for Evacuation 

120 Ft * 3600 sec / 3 miles * 1 mile / 5280 ft = 27.27 seconds, or assume 
28 seconds required for personnel to evacuate area. 

Mass of Hydrazine (M mm) Leaked During Detection/Evacuation Period 


0.28 grams/sec * (time to detect + time to evacuate) = 

0.28 grams/sec * (40 + 28) = 19.04 grams N 2 H 4 or 0.019 Kg N 2 H 4 released 
19.04 grams N 2 H 4 * 1 cc/1.008 grams = 18.9 cc N 2 H 4 or 0.639 oz N 2 H 4 released 
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Since the number of moles of gas per unit volume is given by 


p 71 

m V 

p 

where n is the number of moles of gas present, mass density and molar mass m of the gas: 

M N2H2 = P N2H2 V N2H2 
M N2H2 = P air ( HI N2H2 / HI air ) V N2H2 

0.019 Kg = 1.2 (32/28.6) V N2H 2 
0.019 = 1.34 V N2H4 
V = 0.014 

0.014 / 0.047 = 0.30 m 3 Volume of N 2 H 4 at LEL when evacuation is complete. 

Proceeding as above, but using only time to detect yields 0.17 m 3 volume of N 2 H 4 at LEL when 
evacuation is initiated. 

Conclusion : 

Hydrazine vapor at the lower explosive limit may occupy a volume of 0.32 cubic meters when 
the detector alarm sounds and expands to 0.64 cubic meters in the 28 seconds required to fully 
evacuate the facility. Personnel will be well outside the LEL-occupied volume at all times and 
thus exposed to negligible risk of injury due to fire. Since all materials in the immediate vicinity 
of the leak are hydrazine-compatible, no immediate ignition source is present and ignition of the 
vapor is unlikely before the facility can be evacuated. Consequently, the availability of fire 
detection and suppression equipment does not play a role in this assessment. 

Note that the underlying assumptions are worst-case from the perspective of vapor detection and 
accumulation. KSC tests of the Zellweger CM4 vapor detector suggest that detection times of 
10-20 seconds may be realized in the field with 50-feet of sample tubing and the detector 
configured for automatic tape advance, implying the LEL-occupied volumes may actually be 
smaller than calculated above. Purge gas, if provided, will tend to sweep away and dilute 
hydrazine vapor and reduce the potential for ignition. The calculations were completed for the 
Astrotech processing facility, but the results also hold true for the SLC-2 white room since the 
evacuation distance is considerably shorter (40 vs. 120 feet), and the assumed leak rate much 
lower (10 g/hr vs. 1 Kg/hr). 
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Addendum 8 


PowerPoint Presentation, Update of NESC Requirements/Actions to 
Integrated Program Management Council 


Addendum 8-1 



NASA Engineering and Safety Center (NESC) 


CALIPSO Independent Technical 
Assessment/Inspection (ITA/I) 

03-001 -E 


Update of NESC Requirements/Actions to 
Integrated Program Management Council 

2-02-05 

Rick J. Gilbrech 
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NESC Assessment Overview 


• On 6-Nov-03, GSFC Deputy Director (Bill Townsend) requested NESC to 
review Proteus propulsion bus hydrazine issues related to personnel safety. 

• NESC site visit of VAFB (Astrotech & SLC-2 pad) on 1 7-Dec-03. 

• NESC delivered summary briefing to Integrated Program Management 
Council held at GSFC on 22-Jan-04 with follow up briefing at NASA 
Headquarters to Space Science and S&MA Associate Administrators. 

• NESC ITA/I lead participated in Alcatel site visit week of 12-May-04. 

• NESC supported Ground Ops Working Group meeting at VAFB on S-Jul-04. 

• Status of NESC requirement/actions delivered to IPMC 9-28-04. 

• Final closure update presented today. 
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Problem Statement 


• Review CALIPSO spacecraft design and assess potential for personnel 
exposure to hydrazine propellant. Loss of mission, spacecraft or launch 
facilities were placed outside the scope of this assessment. 

• Assessment focused on three key areas for filled and pressurized hydrazine 
system (L-36 days to lift-off). 

- Leakage from fluid system mechanical fittings 

- Leakage from thrusters 

- Inadvertent firing of thrusters 
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Investigation Team 


Team Members 

Dr. Rick Gilbrech (LaRC) - NESC Principal Engineer 

John McManamen (JSC) - NESC Mech. Sys. Discipline Engineer 

Tim Wilson (KSC) - NESC Chief Engi neer, KSC 

Frank Robinson (GRC) - Safety and Mission Assurance 

Bill Schoren (GRC) - Safety and Mission Assurance 

Expert Consultants 

Ed Zampino (GRC) - Safety and Mission Assurance 

Chris Hansen (JSC) - Mechanical Systems 

Jay Bennett (JSC) - Materials and Processes 

Tom Draus (KSC) - Orbiter Hypergolic Systems 

Dr. Scott Miller (Aerojet) - NESC Consultant 

Jack DeBoer (Aerojet) - NESC Consultant 

Keith Coste (Aerospace Corporation) - NESC Consultant 
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NESC Activities to Date 


* Aerojet A/N fitting hydrazine exposure tests completed 

* Aerospace evaluation report delivered 

* Alcatel site visit complete 

- Note: Alcatel was exceptionally open and cooperative 

* WSTF Proteus propulsion bus hydrazine material compatibility report delivered 

* NESC requirements/actions closure update presented to IPMC 9-28-04 

* KSC modeling/analysis of hydrazine leak detection systems at VAFB completed 

* KSC testing of hydrazine leak detection system planned for VAFB completed 

* KSC fire safety analysis completed 

* NESC CALIPSO Final Report, Revision 2, approved and released 1-27-05 

* NESC final closure status presented today 
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NESC-R-001 - Fitting Assembly 


* Requirement 

- Program shall demonstrate that Alcatel training and/or assembly 
documentation provided for proper lubrication of fluid fittings during 
assembly. Assembly procedures shall clearly delineate the type, quantity 
and location where lubricant was applied and ensure sealing surfaces were 
kept dry and free of any contaminant. 


• Closure Rationale 

- NESC Alcatel site visit revealed traini ng, assembly documentation and 
procedures were clear and adequate to satisfy the requirement 

■ Procedures used to assembly the 5 Proteus A/N fittings clearly called out the type 
and quantity along with the specific location of the lubricant. Training and 
experience of technicians performing the work was sufficient and comparable to 
US spacecraft industry. The work is performed in a 1 00,000 class clean room and 
technicians used appropriate gear (head, body and feet covers along with gloves) 
to keep surfaces dry and free of contaminant. Assembly sequence and jigs 
provide orientations and access conducive to a well-assembled fitting. 

CLOSED 
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NESC-R-002 - Fitting Assembly 


* Requirement 

- Program shall demonstrate that Alcatel training and/or assembly 
documentation provided for a visual inspection of fluid fittings prior to 
assembly. Assembly procedures shall ensure components had no visible 
defects and sealing surfaces were clean and dry. 


• Closure Rationale 

- NESC Alcatel site visit revealed traini ng, assembly documentation and 
procedures were clear and adequate to satisfy the requirement 

■ All surfaces (threads, sleeves and both sides of the conical seals) received a4X 
visual inspection by the quality inspector prior to assembly and all were verified 
clean and dry. 


CLOSED 
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NESC-R-003 - Post Assembly Leak Checks 


* Requirement 

- Program shall demonstrate that the Proteus bus mechanical fittings are 
rigorously tested using techniques adequate to validate system integrity. 
Leak check procedures shall specify test method, equipment to be used, 
media, test pressure and allowable leak rate. 


• Closure Rationale 

- NESC Alcatel site visit revealed leak test procedures and results adequate 
to validate system integrity 

• See following chart for leak test roadmap 


CLOSED 
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Alcatel Helium Leak Test Summary 


Assembled 
Proteus ready 
for 

Acceptance 
T esting 



33 Bar for 
5 minutes 



At 22 Bar: At 13 Bar 

1 - Sniff fittings 

<10e-6 scc/sec 

2 - Overall Leak Test 

<3.4>c10e-5 scc/sec ever 
12 hours 

3 - Thruster Leak T est 

<10e-5 scc/sec per 
thruster 

4 - Fill/Drain Valve Leak Test 

<2.8>d0E-4 per valve 


At 22 Bar: 

1 - Overall Leak T est 

<3.4>c10e-5 scc/sec over 
12 hours 

2 - Thruster Leak T est 

<10e-5 scc/sec per 
thruster with individual 
seat test 

3 - Fill/Drain Valve Leak Test 

<2.3>d0E-4 per valve 



At 2.5 Bar: 

1 - Insert Test/Arm Plugs 

2 - Check Elec. Activation 

of Thrusters 

3 - Verifyflow = 75 

scc/sec per thruster 


At 22 Bar: 

1 -Thruster Leak T est 

<10e-5 scc/sec per thruster 

2 - Fill/D ra in Valve Leak Test 

<2.3>d0E-4 per valve 

3 - Overall Decay via T elemetry after 12 hrs 

Pfinal >21.945 Bar (set at lowest detectable change) 
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NESC-R-004 - Ground Handling Loads 


* Requirement 

- Program shall demonstrate that thermal and vibration loads applied to the 
spacecraft during environmental tests envelope conditions it will experience 
from servicing through launch. 


* Open 

- Alcatel reported vibration test levels of 2 g's at the tank fitting and 8 g's at 
the thruster fittings. These levels envelope the highest recorded ground 
handling loads at VAFB of 0.6 g's. 


Richard J. Gilbrech 
2 - 02-05 


CLOSED 


Note: Open item at 9-28-04 IPMC 
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NESC-R-005 - Handling Environment 


* Requirement 

- Program shall demonstrate that servicing procedures adequately control 
temperature, pressure and flow rates to minimize the potential for leakage. 


• Closure Rationale 

- NESC Alcatel site visit revealed traini ng, assembly documentation and 
procedures were clear and adequate to satisfy the requirement 

■ JASON-1 procedures presented will be used for CALIPSO and clearly delineate fill 
and pressurization rates adequate to preclude large temperature or pressure 
excursions 


CLOSED 
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NESC-R-006 - Handling Environment 


* Requirement 

- Program shall verify that the controls at the processing facility and launch pad 
identified in the final report are in place to monitor for leakage from the time 
hydrazine is loaded until final closeout for launch. 

- Additionally, the program shall verify that spacecraft operations are mi nimized 
after hydrazine loading, and that provisions are made for area securing and the 
rapid evacuation of personnel should a leak develop. 

- Further, the program shall coordinate with all other payload/Delta II processing 
personnel to ensure the program's approach for minimizing personnel exposure 
to potential hazards is properly integrated. 


• Closure Rationale 

- Astrotech payload processing facility and SLC-2 white room capabilities presented by 
Caraballo along with procedures presented at Ground Operations Working Group Meeting 
at VAFB on July 7 , 2004 , are adequate to address facility controls and coordination with all 
other payload/processing personnel. Program indicated tanking can not be moved any 
closer to launch and reviewed the processing timeline to minimize operations after loading. 


CLOSED 
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NESC-R-007 - Thruster Leakage 


* Requirement 

- Program shall demonstrate that pre-servicing thruster leak checks will be 
adequate to validate system integrity. Leak check procedures shall test 
each valve independently and shall specify test method, equipment to be 
used, media, test pressure and allowable leak rate. 


• Closure Rationale 

- NESC Alcatel site visit revealed procedures were clear and adequate to 
satisfy the requirement (reference NESC-R-003 for details). 


CLOSED 
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NESC-R-008 - Thruster Valve Defect Concern 


* Requirement 

- Program shall verify that the Proteus Moog valves on CALIPSO do not have 
defective plunger assemblies. 


• Closure Rationale 

- CALIPSO Proteus thruster valves were supplied by Wright Components Co. 
(also known as EG&G Perkin Elmer) with part number 18207-14, serial 
numbers 029, 030, 033, and 034. The suspect valves with defective plunger 
assemblies were manufactured by MOOG after it purchased Wright 
Components in 2001 and moved manufacturing from Phelps, NY, to East 
Aurora, NY. The CALIPSO thruster valve part number and serial numbers 
used by Alcatel are exempt from the MOOG defective plunger issue. 


CLOSED 
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NESC-R-009 - Thruster Inadvertent Firing 


* Requirement 

- Program shall demonstrate that test procedures verify relays 16 and 17 are 
open before power is applied to the spacecraft. Since the design 
incorporates latching relays, verification of the last stable state by data 
retrieval or written record is acceptable. 


• Closure Rationale 

- Before shipment to VAFB , the ability of the ground operator to close relays 1 6 and 1 7 is 
inhibited by removing the telecommand "close relays 16 and 1 7" from the electrical 
ground support equipment Main Control and Data Test (MCDT) database. The software 
routine that powers off the spacecraft has a step to telecommand open relays 16 and 
17. The independent relay position feedback circuit is checked and if the open 
indication is not received, an error message is displayed on the operators screen. 
Alcatel agreed to add a warning screen instead of an error message on the operator's 
monitor and also add a safety warning in the procedure in case of this error/Warning 
message dealing with relays 1 6 and 17. The forbidden command management 
procedure (removal and verification) will be reviewed at the Pre-Shipping Review before 
the spacecraft leaves Alcatel. 

CLOSED 
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NESC-R-010 - Thruster Inadvertent Firing 


* Requirement 

- Steps for inserting and removi ng test/arm plugs shall be explicitly called out 
in the ground processing timeline. Final installation for flight shall occur as 
late as possible; until that time, plugs shall only be installed as required for 
thruster valve testing. 

• Closure Rationale 

- Alcatel stated that the test/arm plugs will only be used to perform the 
individual thruster valve seat leak tests outline in NESC-R-003. Once these 
tests are completed the plugs will remain in the spacecraft from that poi nt on 
Alcatel's rationale is based on reliability concerns that once the spacecraft is 
fueled, there is no way to verify the test/arm plug function without hot firing 
the thrusters. 


CLOSED 
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NESC-R-011 - Thruster Inadvertent Firing 


* Requirement 

- Program shall verify that all thruster firing circuit inhibits function as 
designed. 


• Closure Rationale 

- Alcatel i ndicated that the individual thruster mass flow test is considered the 
verification of the thruster wiring/inhibit circuitry. No other evidence of 
manufacturing quality inspections or electrical continuity/ resistance/functional 
checkouts was provided. The current Alcatel approach is comparable to 
NASA programs (i.e., to confirm functionality) and is sufficient to close the 
action. 

■ NESC recommended Alcatel exercise all possible combinations of the three 
switches (relays 16,17 and the opto- drivers) to guarantee the inhibits function as 
intended if it could be reasonably accommodated. Current testing will activate four 
of the eight possible combinations. This is under consideration by Alcatel but not 
required. 


CLOSED 
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IPMC #1 - Fire Hazard Analysis 


* Requirement 

- NESC to examine the magnitude of a fire hazard associated with hydrazine 
leakage onto adjacent materials and recommend suitable mitigation 
activities. 

• Closure Rationale 

• Proteus propulsion bus hydrazine materials compatibility analysis/test by 
White Sands Test Facility indicated no credible ignition sources. 

• KSC analysis/test of VAFB hydrazine leak detection systems concluded 
Zellweger Analytics CM4 hydrazine detector consistently detected 
hydrazine in sufficient timeframe and resolution to be an effective safety 
alarm 

- Minimize CM4tube lengths to minimize alarm delay 

- Recognize long fallback times (or time for instrument to clear and 
resume accurate detection) after alarms with high concentration 
(e.g., 40 minutes for 1 part per million) 
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IPMC #1 - Fire Hazard Analysis (cont.) 
KSC Leak Detector Test Results 


CM4 Alarm Tines vs. Sample Tube Length 



CM4 Fallback Time us. Tubing Length 
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IPMC #1 - Fire Hazard Analysis (cont.) 


• Closure Rationale (cont.) 

• KSC fire safety analysis concluded that a hydrazine leak, given the 
results above, presents very little risk to facility occupants at Astrotech 
and the SLC-2 white room (personnel egress times, toxicity hazard, fire 
potential and lower explosive limit considered). 

• NESC concurs with the supplemental safeguards planned by Program 

- Enhanced hydrazine monitoring - CM4, sniff checks, dosimeter badges, 
portable detector spot checks 

- Enhanced training & evacuation drills 

- Streamlined processing - essential personnel only, peer review of lifting ops 

- Single safety lead 


Richard J. Gilbrech 
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Note: Open item at 9-28-04 IPMC 
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IPMC #2 - VAFB Capability 


* Requirement 

- NESC to work with VAFB to assess the adequacy of range capabilities to 
handle hydrazine leak rates ranging from catastrophic to plausible. 

• Closure Rationale 

- Results from IPMC #1 were discussed with Astrotech , Boeing SLC-2 pad 
personnel and VAFB Range on 1-25-05. They confirmed that they can 
handle the worst case scenario considered: 

30 kg (~8 gallons) of hydrazine at 22 bar (319 psi) 


Worst case leak rate at payload processing facility: 
Worst case leak rate at launch pad white room: 


1 kg/hr 
10 g/hr 


CLOSED 


Note: Open item at 9-28-04 IPMC 
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IPMC #7 - Before/After 5x5 Risk Matrix 


* Requirement 

- NESC to provide a risk assessment (NASA 5x5 matrix) of the potential for 
personnel exposure to hydrazine propellant once all of the propulsion actions 
are completed. Loss of mission , spacecraft or launch facilities were placed 
outside the scope of this assessment. 


• Closure Rationale 

- Successful closure of all 1 1 NESC requirements and IPMC Actions #1 & #2. 


Richard J. Gilbrech 
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Note: Open item at 9-28-04 IPMC 
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Addendum 8-23 



CALIPSO Personnel Hazard from Hydrazine Exposure 



HAZARDOUS EVENTS 

A- Personnel Injury from Hydrazine Leakage from Mechanical Fittings 
B - Personnel Injury from Inadvertent Opening of Thruster Valves 
C - Personnel Injury from Hydrazine Leakage from Thruster Valves 

ASSESSMENTS 

liiuai — Initial NESO Assessment 
trial - Final NESC Assessment 
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